CVE-2026-115930 MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

The MongoDB Shell mongosh relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell mongosh versions prior to 2.14.0 and can be resolved by updating ...

EUVD-2026-109932

The MongoDB Shell mongosh relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell mongosh versions prior to 2.14.0 and can be resolved by updating ...

CVE-2026-115930

The MongoDB Shell (mongosh) is vulnerable in versions prior to 2.14.0 because its underlying Node.js runtime includes recoverable eMudhra intermediate CA certificates in its TLS root certificate store. This configuration could allow for improper certificate validation. Impacted users should updat...

MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

The MongoDB Shell mongosh relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell mongosh versions prior to 2.14.0 and can be resolved by updating ...

cybersecurity-lab-reports

🛡️ Red Team & Cybersecurity Engineering Technical Reports Wel...

MSC-2026-13073

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13086

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13072

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13042

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive private user information...

MSC-2026-13036

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

yandex-station-2-s905x2-root Root shell on Amlogic S905X2 And...

jboss-autopwn

⚠️ NOTE: This tool is no longer under active maintenance. JBoss Autopwn Script Christian G. Papathanasiou http://www.spiderlabs.com INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss AS server. Once deployed, the script uses its upload and command execution capability to provid...

Webmin_Exploit_reverse_shell

ntroduction: The Webmin Exploit is a targeted exploit for the Webmin service, which can be exploited on older versions of Webmin. This exploit uses various techniques to execute malicious code and gain unauthorized access to the target system. It involves: Using both C and Assembly code to execut...

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection

Sunhillo SureLine 8.7.0.1.1 is vulnerable to OS command injection. The /cgi/networkDiag.cgi script directly incorporated user-controllable parameters within a shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. The following POST request...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

UBUNTU-CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...

PT-2026-123348

The MongoDB Shell mongosh relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell mongosh versions prior to 2.14.0 and can be resolved by updating ...