EUVD-2026-10552

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints...

ROS-20260311-73-0002

Vulnerability in mongodb-org related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

Splunk Enterprise 9.3.0 < 9.3.10, 9.4.0 < 9.4.9, 10.0.0 < 10.0.4, 10.2.0 < 10.2.1 (SVD-2026-0304)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0304 advisory. - In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7,...

PT-2026-24689

Impact The protectedFields class-level permission CLP can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This...

ROS-20260311-73-0004

Vulnerability in mongodb-org related to a flaw in the use of assert. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260311-73-0008

A vulnerability in the MongoDB Query Planner component of the MongoDB kernel is related to unrestricted resource allocation. Exploitation of the vulnerability could allow a remote attacker to cause a denial-of-service condition...

ROS-20260311-73-0001

Vulnerability in mongodb-org related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260311-73-0005

Vulnerability in mongodb-org related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260311-73-0003

Vulnerability in mongodb-org related to flaws in authorization procedure. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20260311-73-0009

A vulnerability in the MongoDB database management system server is related to incorrect data type conversion. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260311-73-0006

A vulnerability in the internal locking mechanism of the MongoDB database management system is related to locking with unrestricted external access. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260311-73-0007

A vulnerability in the MongoDB database management system server is related to uncontrolled recursion. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

@snickbit/feathers-logs (>=1.0.0-0, <=1.0.27), @snickbit/feathers-mongo (>=1.0.0-0, <=2.0.11) +6 more potentially affected by CVE-2026-29793 via @feathersjs/mongodb (>=5.0.0-pre.20, <=5.0.12)

@feathersjs/mongodb NPM version =5.0.0-pre.20, =1.0.0-0, =1.0.0-0, =1.0.0-0, =0.0.29, =0.0.29, =0.0.29, =2.0.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29793 Source advisory: SNYK:JS-FEATHERSJSMONGODB-15456216...

NoSQL Injection

Overview @feathersjs/mongodb is a Feathers MongoDB service adapter Affected versions of this package are vulnerable to NoSQL Injection via the id parameter in WebSocket requests, passed through getObjectId, which fails to perform type checking. An attacker can inject database queries by sending...

EUVD-2026-10927

Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL e.g., 30 seconds, the TTL index is...

EUVD-2026-10926

Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL e.g., 30 seconds, the TTL index is...

EUVD-2026-10826

Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter...

Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId and land directly in the...

@snickbit/feathers-logs (>=1.0.0-0, <=1.0.27), @snickbit/feathers-mongo (>=1.0.0-0, <=2.0.11) +6 more potentially affected by CVE-2026-29793 via @feathersjs/mongodb (>=5.0.0-pre.20, <=5.0.12)

@feathersjs/mongodb NPM version =5.0.0-pre.20, =1.0.0-0, =1.0.0-0, =1.0.0-0, =0.0.29, =0.0.29, =0.0.29, =2.0.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29793 Source advisory: OSV:GHSA-P9XR-7P9P-GPQX...

GHSA-P9XR-7P9P-GPQX Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId and land directly in the...