CVE-2026-72639

Summary: CVE-2026-72639 affects Elasticsearch highlighting handling of a user-supplied count, where there is no upper bound on the count and the resulting allocation is not bounded by a circuit breaker. An authenticated user with read privileges on a single index can trigger a single, small query...

PT-2026-71757

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one...

PT-2026-70859

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...