GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: rclone, k6, terraform, zot, minio, grafana, dex, spqr, cert-manager-csi-driver, rancher, openbao, external-secrets-operator, telegraf, cert-manager-cmctl, ratify, frp, opentofu, percona-server-mongodb-operator, seaweedfs, harbor, gitlab-runner, teleport, nuclei,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: rclone, k6, terraform, zot, minio, grafana, dex, spqr, cert-manager-csi-driver, rancher, openbao, external-secrets-operator, telegraf, cert-manager-cmctl, ratify, frp, opentofu, percona-server-mongodb-operator, seaweedfs, harbor, gitlab-runner, teleport, nuclei,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: nuclei, syncthing, cert-manager-csi-driver-fips, telegraf, cert-manager-openshift-routes, agentbeat, rclone, zitadel, beats, gitlab-runner, harbor, neuvector, grafana-fips, external-secrets-operator, cert-manager-csi-driver, percona-server-mongodb-operator,...

CVE-2026-40351

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

EUVD-2026-23557

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: headlamp-fips, envoy-gateway, falcoctl, k9s, kubescape-server-fips, kots, k8ssandra-client-fips, kcp, eck-operator-fips, kcp-0.29, plugin-barman-cloud-fips, gitlab-runner, neuvector, grafana-fips, linkerd2-fips, zarf, velero-fips, kiali-fips, docker-cli-buildx-fips,...

PT-2026-33519

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver-fips, mariadb-operator-fips, aws-privateca-issuer, cert-manager-openshift-routes, cert-manager-istio-csr, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, aws-privateca-issuer-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, step-issuer, percona-server-mongodb-operator, aws-privateca-issuer, cert-manager-cmctl, cert-manager-csi-driver, opentelemetry-operator, mariadb-operator, cert-manager-istio-csr...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, step-issuer, percona-server-mongodb-operator, aws-privateca-issuer, cert-manager-cmctl, cert-manager-csi-driver, opentelemetry-operator, mariadb-operator, cert-manager-istio-csr...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver-fips, mariadb-operator-fips, aws-privateca-issuer, cert-manager-openshift-routes, cert-manager-istio-csr, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, aws-privateca-issuer-fips,...

EUVD-2020-23328

Malware in sbrugna...

CVE-2020-35666

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

Sql injection

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

PT-2020-19848 · Mongodb · Mongodb Enterprise Kubernetes Operator

Name of the Vulnerable Software and Affected Versions: MongoDB Enterprise Kubernetes Operator versions 1.0 through 1.1 MongoDB Enterprise Kubernetes Operator version 1.2 through 1.2.3 MongoDB Enterprise Kubernetes Operator version 1.3 through 1.3.0 MongoDB Enterprise Kubernetes Operator version 1...