Linux Distros Unpatched Vulnerability : CVE-2026-88033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file...

Oracle Linux 10 / 8 / 9 : java-21-openjdk (ELSA-2026-42895)

The remote Oracle Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42895 advisory. 1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625...

Apache Artemis 1.3.0 < 2.45.0 / 2.50.0 < 2.57.0 Denial of Service (CVE-2026-57822)

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by a vulnerability: - When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java (CVE-2026-41586)

Summary IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java Vulnerability Details CVEID:CVE-2026-41586 DESCRIPTION: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the getFrameContentSizebyte, int, int, boolean bounds check in src/main/java/com/github/luben/zstd/Zstd.java. An attacker can trigger a JVM crash or read past the start of the input buffer by supplying a negative...

DEBIAN-CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

DEBIAN-CVE-2026-88032

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88032

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88032

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

UBUNTU-CVE-2026-88032

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

UBUNTU-CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-88033 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88033

MongoDB Java Driver 's GridFS component is vulnerable to query-operator injection through improperly neutralized file identifiers. A caller-supplied structured file ID may be interpreted as a query condition rather than a literal value, allowing an authenticated user who can influence the identif...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75669

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88033 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...