go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs

A flaw was found in go.mongodb.org/mongo-driver for version 1.17.10 and 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored fil...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...

CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

CVE-2026-114647

The MongoDB C# Driver is vulnerable to a NoSQL operator injection because the FindOneAndReplace operation fails to reject replacement documents with top-level field names starting with a dollar sign ($) . If an application constructs such a document using user-supplied field names , an attacker c...

CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

PT-2026-118511

Name of the Vulnerable Software and Affected Versions @apostrophecms/import-export versions prior to 3.7.0 Description An authenticated user with import access to a target type can manipulate the update-by-key feature to modify documents they did not explicitly identify. The getUpdateKey and...

MiracleLinux 8 : python36:3.6 (AXSA:2026-2086:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2086:01 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding...

CVE-2026-111602 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...

CVE-2026-111602

The LatePoint | Calendar & Scheduling WordPress plugin is vulnerable to Sensitive Information Exposure in versions up to and including 5.7.4 . The root cause is an ORM Operator Injection occurring via the params (customer[uuid]) parameter. This allows unauthenticated attackers to extract sensitiv...

CVE-2026-111602 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...

RLSA-2026:82858 Important: python36:3.6 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python36:3.6 security update

An update is available for module.python-distro, python-virtualenv, python-docs, module.python-docs, module.python-sqlalchemy, module.python-pymongo, module.python-wheel, module.python-PyMySQL, python-nose, module.python-pygments, scipy, module.python36, python-PyMySQL, python36, python-wheel,...

Rocky Linux 8 [CIQ] Security Update: python-nose-docs / python-pymongo-debuginfo / etc (crlsa-2026_82858)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

AlmaLinux 8 : python36:3.6 (ALSA-2026:82858)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

Important: Red Hat Security Advisory: python36:3.6 security update

An update for the python36:3.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Python Driver pymongo. The driver can treat a caller-supplied structured file identifier as a MongoDB query condition instead of a literal identifier. An authenticated user who can influence the identifier passed to GridFS download, delete, ...

ALSA-2026:82858 Important: python36:3.6 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 8 : python36:3.6 (RLSA-2026:82858)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...