Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : libEBML vulnerability (USN-8746-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8746-1 advisory. It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a...

USN-8746-1 libebml vulnerability

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

USN-8746-1: libEBML vulnerability

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

PT-2026-89732

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

CVE-2026-76560 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-18704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections...

CVE-2026-81526

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...

PT-2026-82740

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...

EUVD-2026-62939

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76374 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-62667

CVE-2026-62667 affects the Grav API Plugin (a RESTful API for Grav CMS) prior to version 1.0.6 . The root cause is an authorization bypass : ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() never reads or enforces it, returning the owning user's...

CVE-2026-76243

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments...

EUVD-2026-62407

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments...

CVE-2026-76243

stigmem (stigmem-node) versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with an anonymous identity when nodes are exposed outside local development environments. The CVSS ...

CVE-2026-18704

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

CVE-2026-18704

Summary: CVE-2026-18704 affects MongoDB Server's aggregation framework. Affected component is an internal-use aggregation stage that is reachable by external clients without proper authorization checks on its embedded operations. This could allow an authenticated user with only read privileges to...

CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

GHSA-HC8V-WWC9-VGXM go-git: Worktree operations may follow symlinks

Impact A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not...

CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...