CVE-2026-88023

CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-88022

CVE-2026-88022 affects the MongoDB integration for Laravel , where improper neutralization of special elements in data query logic allows an array supplied to an explicit equality filter to be interpreted as a query condition rather than a literal value. The vulnerability impacts the three-argume...

EUVD-2026-75583

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...

CVE-2026-88897

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

GO-2026-6353 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel...

EUVD-2026-75542

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-88897

Flextype CMS versions up to 1.0.0-alpha.3 transmit API authentication credentials via URL query string parameters in REST API routes. Because query strings are commonly logged, an attacker with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API a...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

Material for MkDocs: DOM XSS in search suggestions via query parameter

ImpactMaterial for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. PatchesThe issue is fixed in Material for...

PYSEC-2026-3864 Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...