CLEANSTART-2026-DI61732 Security fixes in prometheus-mongodb-exporter 0.47.2-r1

Package prometheus-mongodb-exporter version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-KI83481 Security fixes in prometheus-mongodb-exporter-fips 0.47.2-r1

Package prometheus-mongodb-exporter-fips version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-HD27625 Security fixes in mongodb 8.1.3-r1

Package mongodb version 8.1.3-r1 fixes 1 vulnerabilities: CVE-2026-46600...

CLEANSTART-2026-DY40208 Security fixes in mongodb 8.0.23-r2

Package mongodb version 8.0.23-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-IV17968 Security fixes in mongodb 7.0.32-r1

Package mongodb version 7.0.32-r1 fixes 19 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-IB04724 Security fixes in mongodb 7.0.34-r2

Package mongodb version 7.0.34-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-OW39793 Security fixes in mongodb 8.2.1-r1

Package mongodb version 8.2.1-r1 fixes 3 vulnerabilities: CVE-2025-61727, CVE-2025-58181, CVE-2025-14847...

CLEANSTART-2026-CN16573 Security fixes in percona-server-mongodb-operator 1.22.0-r1

Package percona-server-mongodb-operator version 1.22.0-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

MongoDB 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-125872)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...

MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...

MongoDB 8.0.x < 8.0.28 Aggregation Command Invariant Assertion Failure (SERVER-128512)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28. It is, therefore, affected by a vulnerability: - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of...

MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)

The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: nerdctl, kots, omnictl-multiarch, elastic-agent-fips, snyk-cli, flux, prometheus, commercial-expanso-edge, k3d, kaf, kyverno, telegraf, terraform, prometheus-mongodb-exporter, cilium, minio, kine, zot, cert-manager, zitadel, backup-restore-operator, aactl,...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

This Week in Spring - July 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! The title says in Spring , but here in the northern hemisphere, it's clearly the middle of summer. Hot! I'm sitting here on my laptop on a warm summer day, and my laptop is indeed hot because I've spent so much time outside...

PT-2026-65520

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...