CVE-2026-93763

This vulnerability affects Mongoid , a Ruby object-document mapper for MongoDB. A protection mechanism failure in the encryption configuration generation — specifically an unresolved callable database name in the encryption schema map — causes fields declared for client-side field-level encryptio...

Silent plaintext persistence via unresolved callable database name in encryption schema map

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...

CVE-2026-93763 Silent plaintext persistence via unresolved callable database name in encryption schema map

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...

CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...

MongoDB 7.0.x < 7.0.43 / 8.0.x < 8.0.32 / 8.3.x < 8.3.11 Memory Corruption

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.43, 8.0.x prior to 8.0.32, or 8.3.x prior to 8.3.11. It is, therefore, affected by a memory corruption vulnerability: - A race condition in the document value layer of MongoDB Server can allow concurrent server threads to...

GHSA-QRFJ-MGW8-J9C6 @platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

CVE-2026-54504

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with STARTWEBUI enabled by default and WEBPORT set to 3080...

CVE-2026-54504

CVE-2026-54504 affects MCP Documentation Server (@andrea9293/mcp-documentation-server) versions 1.13.0 through 1.13.1 . The root cause is that app.listen(PORT) in src/web-server.ts is called without a host argument, causing the Express server to bind to all interfaces (0.0.0.0:3080) rather than l...

CVE-2026-54504 MCP Documentation Server: Web UI API binds to all interfaces without authentication by default

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with STARTWEBUI enabled by default and WEBPORT set to 3080...

CVE-2026-54504 MCP Documentation Server: Web UI API binds to all interfaces without authentication by default

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with STARTWEBUI enabled by default and WEBPORT set to 3080...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-81546

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 (September 2026 release) contain a stack-based buffer overflow caused by inadequate bounds checking when parsing Affinity document files. A threat actor could craft a malicious Affinity document that, when opened by a user, may lead to arbitrary code exec...

EUVD-2026-81313

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...

CVE-2026-81546

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...

CVE-2026-54504: Missing Authentication for Critical Function

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with STARTWEBUI enabled by default and WEBPORT set to 3080...

CVE-2026-81546: Stack-based Buffer Overflow

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...