MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

CVE-2026-62145

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

EUVD-2026-47702

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

CVE-2026-62145

CVE-2026-62145 affects Check Point Gaia Portal. An authenticated user with read-only Gaia Portal privileges can escalate to root privileges by executing commands, with CVSS 3.1: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 7.5). Impact is high (confidentiality, integrity, availability). Exploi...

PT-2026-63469

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

PT-2026-63477

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

PT-2026-63411

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

CVE-2026-46403

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

CVE-2026-56146

CVE-2026-56146 : In Kibana, an improper access control (CWE-284) in the Entity Analytics Watchlist configuration allows a low-privileged, authenticated user with read-only Security Solution access to perform write operations on watchlist data that should require elevated privileges, and potential...

CVE-2026-46403

Summary (verified): Klever-Go KVM read-only execution can leak state changes via contract delete/upgrade side effects when invoked through ExecuteReadOnlyWithTypedArguments. The root cause is applying read-only as runtime state while not enforcing it in state-changing host-core paths, allowing a ...

CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

CVE-2026-64146

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. During the initialization of inode extended attributes xattrs, certain error conditions can lead to a leak of metadata buffers. This memory leak can result in a denial of service DoS due to resource exhaustion...

PT-2026-62094

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper Access Control allows a low-privileged authenticated user with read-only Security Solution access to perform write operations on Entity Analytics Watchlist configuration, which should...

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

Exploit for CVE-2026-60137

Compromise Scanner for wp2shell read-only A standalone, r...

CVE-2026-4938

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized...

CVE-2026-4938 Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized...

EUVD-2026-45293

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized...

CVE-2026-4938 Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized...