BIT-MONGODB-2025-14345 Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction...

Updated apache packages fix security vulnerabilities

http2: double free and possible RCE on early reset. CVE-2026-23918 modrewrite elevation of privileges via apexpr. CVE-2026-24072 buffer overflow in modproxyajp via ajpmsgcheckheader. CVE-2026-28780 modmd unrestricted OCSP response. CVE-2026-29168 moddavlock indirect lock crash. CVE-2026-29169...

Bypass of second factor authentication on DAV endpoints by reusing a pre-2FA session ID

None...

freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The StreamEnsureCapacity function can create an endless blocking loop, leading to a Denial of Service DoS. This vulnerability can be exploited on 32-bit systems where the available physical memory is greater than o...

CVE-2025-11159

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator...

CVE-2026-44258

creationtimestamp| type| source ---|---|--- 2026-05-13 06:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116565739119113435 2026-05-13 06:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlpmt5s6m52m...

Important: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-2725

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" ta...

CVE-2025-62624

creationtimestamp| type| source ---|---|--- 2026-05-13 05:05:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpjquxwyp2e 2026-05-13 05:15:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpkddgxeu2k...

CVE-2025-62623

creationtimestamp| type| source ---|---|--- 2026-05-13 04:55:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpj6xekod2k 2026-05-13 05:00:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpjhw52sy2n...

CVE-2026-44257

creationtimestamp| type| source ---|---|--- 2026-05-13 04:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlphsg4x3b23 2026-05-13 04:30:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116565385652211978...

CVE-2026-6828

Fluent Forms for WordPress (versions

EUVD-2026-29897

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permissionmessage' parameter in all versions up to, and including, 6.2.1 due to insufficient input sanitization and output escaping...

CVE-2026-41901

creationtimestamp| type| source ---|---|--- 2026-05-13 01:34:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlp5xdbnw42p 2026-05-13 03:10:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlpddjlakx2w...

CVE-2026-42289

creationtimestamp| type| source ---|---|--- 2026-05-13 01:15:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlp4whzqty2h 2026-05-13 03:13:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlpdivu7g22z...

freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The StreamEnsureCapacity function can create an endless blocking loop, leading to a Denial of Service DoS. This vulnerability can be exploited on 32-bit systems where the available physical memory is greater than o...

CVE-2026-8200 Schema validation log messages may not redact user data

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 version...

CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to...

PT-2026-40755

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS affected versions not specified Description A server-side request forgery SSRF issue in the IKEv2 implementation allows an unauthenticated attacker to force the firewall to send network requests to unintended...

PT-2026-40818

Name of the Vulnerable Software and Affected Versions CVAT versions 2.5.0 through 2.63.0 Description An attacker with permissions to create or edit an annotation guide on a task can inject malicious JavaScript code. This code executes in the browser of any user who opens the affected guide,...