474644 matches found
CVE-2026-114652
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114647
The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...
CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114652
The MongoDB C# Driver contains a data-query-logic neutralization weakness within the update-statement construction component . This vulnerability allows an attacker who can influence application-supplied values to have those values interpreted as query/update logic rather than literal data. A use...
EUVD-2026-108323
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
EUVD-2026-108312
The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...
CVE-2026-115372 Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject argumen...
CVE-2026-115372
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject argumen...
EUVD-2026-108295
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject argumen...
CVE-2026-115372
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject argumen...
CLSA-2026-1792696243 TuxCare security update for org.bouncycastle (9 CVEs)
TuxCare rebuilt 39 org.bouncycastle packages to address 9 CVEs. Fixed in 1.75-tuxcare.1...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
CVE-2026-77157
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
CLSA-2026-1792692686 TuxCare security update for 39 packages (15 CVEs)
TuxCare rebuilt 39 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1...
CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
CVE-2026-77157
The ast-cli tool is vulnerable to arbitrary binary execution because it fails to verify checksums for helper binaries (Vorpal ASCA real-time engine and SCA Resolver) during its auto-update flow. This flow is triggered by Checkmarx VSCode/JetBrains extensions and the cx scan "sca-realtime" command...
CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...