EUVD-2026-75643

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

CVE-2026-88024

CVE-2026-88024 affects the GridFS component of the MongoDB Rust Driver . A caller-supplied structured file identifier is not properly neutralized in query logic, allowing it to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identi...

CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-80351

creationtimestamp| type| source ---|---|--- 2026-09-10 17:00:11+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6jndegk32p 2026-09-15 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvju4tql6g2r...

CVE-2026-88890

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder . The root cause is a failure to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses . An authenticated attacker holding project-scoped read or...

CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

GHSA-27J2-H3M2-8237 Apache FreeMarker template loading mechanism vulnerable to path traversal

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

DEBIAN-CVE-2026-84939

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

CVE-2026-84939

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

CVE-2026-84939

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

UBUNTU-CVE-2026-84939

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

CVE-2026-84939

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

PT-2026-89515

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

MongoDB Ruby Driver - Improper neutralization of special elements in data query logic in the GridFS component

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88028: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

PT-2026-89542

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the polymorphic relation handling allows a caller-supplied relation identifier to be interpreted...

PT-2026-89279

Name of the Vulnerable Software and Affected Versions Apache FreeMarker versions 2.2.0 through 2.3.34 Description A path traversal issue exists in the template loading mechanism when the localized lookup configuration setting is enabled. An attacker can exploit this by providing a malformed local...

PT-2026-89547

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a que...

PT-2026-89550

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...