CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581

The MongoDB Java Driver contains a vulnerability in its BSON encoding component where it fails to verify that an externally supplied raw document's self-declared length matches the actual byte range provided. If an application wraps untrusted raw bytes into such a document for use in a database c...

EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Summary josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Becau...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.111 and prior to 6.18.53. This vulnerability arises because lan966xfdmareload fails to restore rx-pageorder and rx-maxmtu upon failure to reload, as well as fails to restore the old page pool registration for XDP RXQs on each...

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

CVE-2026-98741

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

CLSA-2026-1792073622 ghostscript: Fix of CVE-2026-39919

CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling...

CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

CVE-2026-55587

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A maliciou...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the sa...

CLSA-2026-1792075420 ghostscript: Fix of CVE-2026-39919

CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling...

CLSA-2026-1792074631 ghostscript: Fix of CVE-2026-39919

CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling...

DEBIAN-CVE-2026-109950

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages...

CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...