CVE-2026-4358

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution SBE engine when an in-memory hash table is spilled to disk...

CVE-2025-6706

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

abilian-sbe (>=1.1.0, <=1.1.12), acfx (>=0.3.1, <=0.3.7.dev2) +769 more potentially affected by CVE-2026-102598 via werkzeug (>=3.0.0, <=3.1.8)

werkzeug PYPI version =3.0.0, =1.1.0, =0.3.1, =4.11.0, =2.9.0, =1.0.0, =0.1.3, =0.2.4.1, =0.0.1, =1.3.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-102598 Source advisory: OSV:GHSA-G6X2-HCCM-HH4M...

abilian-sbe (>=1.1.0, <=1.1.12), acfx (>=0.3.1, <=0.3.7.dev2) +769 more potentially affected by CVE-2026-102598 via werkzeug (>=3.0.0, <=3.1.8)

werkzeug PYPI version =3.0.0, =1.1.0, =0.3.1, =4.11.0, =2.9.0, =1.0.0, =0.1.3, =0.2.4.1, =0.0.1, =1.3.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-102598 Source advisory: SNYK:PYTHON-WERKZEUG-20305246...

CVE-2026-4358

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution SBE engine when an in-memory hash table is spilled to disk...

CVE-2026-4358: Double Free

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution SBE engine when an in-memory hash table is spilled to disk...

abilian-sbe (1.0.5), abilian-sbe-next (1.0.4) +159 more potentially affected by CVE-2026-21860 via werkzeug (2.0.3)

werkzeug PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - abilian-sbe 1.0.5 - abilian-sbe-next 1.0.4 - actinia-core 4.9.0 - aiqc =5.0.1, =0.3.2, =4.1.0, =3.11.0, =4.0.0, =0.8.0, =0.0.7, =5.2.15, =0.18.1...

EUVD-2018-10100

Malware in sbrugna...

BIT-MONGODB-2025-6706 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

CVE-2025-6706 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

CVE-2025-6706

CVE-2025-6706 affects MongoDB Server when the SBE engine is enabled. An authenticated user can trigger a use-after-free via a specific aggregation pipeline pattern, potentially crashing the server and causing other unexpected behavior without needing shutdown privileges. Affected versions are Mon...

Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

CVE-2025-6706: Use After Free

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

FreeBSD : MongoDB -- Running certain aggregation operations with the SBE engine may lead to unexpected behavior (5e64770c-52aa-11f0-b522-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5e64770c-52aa-11f0-b522-b42e991fc52e advisory. [email protected] reports: An authenticated user may trigger a use after free that may result in MongoDB...

MongoDB -- Running certain aggregation operations with the SBE engine may lead to unexpected behavior

[email protected] reports: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework...

a-api-server (1.3.0), aau-ais-dipaal (>=0.1.22, <=0.1.29) +2390 more potentially affected by CVE-2025-27516 via jinja2 (>=3.0.0a1, <=3.1.5)

jinja2 PYPI version =3.0.0a1, =0.1.22, =1.0.2, =0.0.2, =0.0.1, =0.8.44.4rc1, =0.0.1, =1.0.0, =1.3.0, =1.4.1 - adminui 1.5.2 and more Source cves: CVE-2025-27516 Source advisory: OSV:GHSA-CPWX-VRP4-4PQ7...

CVE-2021-20487

IBM Power9 Self Boot EngineSBE could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process...

Code injection

IBM Power9 Self Boot EngineSBE could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process...

CVE-2021-20487

IBM Power9 Self Boot EngineSBE could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process...

CVE-2021-20487

CVE-2021-20487 affects IBM Power9 Self Boot Engine (SBE). The SBE vulnerability could let a privileged user inject malicious code and compromise the integrity of the host firmware by bypassing the host firmware signature verification process. Affects IBM Power Systems with Power9 SBE, with remedi...