CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

EUVD-2026-72953

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during curso...

CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during curso...

CVE-2026-82063

A use-after-free flaw in the cursor management component of MongoDB Server allows an authenticated user to trigger a denial of service . Under specific timing conditions during cursor operations, a stale pointer to a freed resource is retained and dereferenced during cursor cleanup, causing a ser...

EUVD-2026-72950

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during curso...

Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during curso...

Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...

Security Bulletin: A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

Summary A path traversal vulnerability existed in two independent file handling mechanisms used by the product's workflow execution and file management capabilities. The file upload endpoint accepted multipart filenames directly from HTTP request metadata without sanitization, allowing an...

0xM0nCrush

0xM0nCrush A cross-version Windows process terminator. It loads a signed HONOR kernel driver MonProcessEX.sys, resolves the PID of every target process, and terminates it from kernel context through a single IOCTL. No kernel offsets, no PDB downloads, no build-specific shellcode - the technique...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF CVE-2024-48360 | Qualitor = v8.24 Unauthenticated SSRF Description Qualitor is a platform for business process management, and this system is present in various companies in Brazil that can be identified simply by using Google dorking. Our te...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.12 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...

CVE-2026-79577

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

CVE-2026-79576

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-79571

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

SkillSpector v2.11.1

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

K000163234: BIND vulnerability CVE-2026-11331

Security Advisory Description An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may...