CVE-2026-47668: Improper Input Validation

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

jq NUL Handling DoS

The vulnerability of the jq JSON processing tool is related to the lack of measures taken to eliminate the zero byte or NUL character. Exploiting this vulnerability can allow an attacker to cause a service failure...

jq jv_contains Heap Buffer Overflow DoS

The vulnerability of the jvcontains function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

jq Heap Buffer Overflow DoS

The vulnerability of the jvobjectmergerecursive function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

jq decNumberFromString Buffer Overflow DoS

The vulnerability of the decNumberFromString function in the jq JSON processing tool is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

jq JSON Processing Tool Heap Buffer Overflow DoS

The vulnerability in the src/linker.c file of the jq JSON processing tool lies in the lack of measures taken to eliminate the zero byte or NUL character. Exploiting this vulnerability could allow an attacker to cause a service failure...

Improper Encoding or Escaping of Output

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the import of a crafted overrides.json settings file. An attacker can execute arbitrary code with the privileges of the affected user by...

CVE-2026-16630

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...

NPM: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

NPM: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

GHSA-777W-RPR6-C52H n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-alg$self-header-alg from the token's own header and then calls...

UBUNTU-CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-13072

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default...

CVE-2026-13064

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

UBUNTU-CVE-2026-13064

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

CVE-2026-13064

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

CVE-2026-9737 Find command with $meta sort can lead to crash

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...