MongoDB Server 8.2.2 Information Disclosure Scanner

MongoDB Server versions through 8.2.2 contain an unauthenticated zlib compressed-protocol information disclosure vulnerability. The scanner identifies servers, enumerates unauthenticated read access, evaluates affected versions, and tests whether zlib compressed frames are accepted...

CVE-2025-14847

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3,...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (October 2026 - Part 2 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in a...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.4.0 and 10.2.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

MongoDB Server 8.2.2 Zlib Memory Disclosure

MongoDB Server versions 3.6 through 8.2.2 contain a zlib-compressed protocol header length handling flaw that may allow an unauthenticated client to read uninitialized heap memory. This submission provides vulnerability information and mitigation guidance...

CVE-2026-68911

A flaw was found in nicotine-plus. A remote attacker can trigger a Denial of Service DoS by sending specially crafted, zlib-compressed peer messages containing a decompression bomb. When the recipient client decompresses the message, it exhausts available operating system memory, causing the...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911

The Nicotine+ graphical client for the Soulseek peer-to-peer network is vulnerable to a decompression bomb in versions prior to 3.3.11 . A modified remote client can send zlib-compressed peer messages that, when processed, exhaust the recipient's operating system memory. This issue has been addre...

CVE-2026-68911: Improper Handling of Highly Compressed Data (Data Amplification)

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

PT-2026-102638

Name of the Vulnerable Software and Affected Versions Nicotine+ versions prior to 3.3.11 Description A modified remote client can send zlib-compressed peer messages containing a decompression bomb, which is a malicious archive designed to crash a system by consuming excessive resources during...

PT-2026-96071

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p14 Checkmk versions prior to 2.4.0p37 Checkmk versions prior to 2.3.0p51 Checkmk version 2.2.0 Description Improper handling of highly compressed data, known as data amplification, allows an attacker controlling...

PT-2026-32484

Name of the Vulnerable Software and Affected Versions MongoDB versions prior to 1:3.6.9+really3.6.8+90g8e540c0b6d-0ubuntu5.3+esm1 Description MongoDB incorrectly handled length parameters in zlib-compressed network messages before authentication. This allows an unauthenticated remote attacker to...

CVE-2025-14847

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3,...

CVE-2025-14847: Improper Handling of Length Parameter Inconsistency

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3,...

CVE-2025-5087

CVE-2025-5087 affects Kaleris NAVIS N4 ULC (Ultra Light Client). The connected documents describe an unsafe Java deserialization vulnerability and insecure transmission of zlib-compressed data over HTTP, enabling an attacker who can observe traffic between Ultra Light Clients and N4 servers to ex...

CVE-2025-5087: Cleartext Transmission of Sensitive Information

Kaleris NAVIS N4 ULC Ultra Light Client communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credentials...

PT-2025-26770 · Aleris +1 · Kaleris Navis N4 Ulc +1

Name of the Vulnerable Software and Affected Versions: Kaleris NAVIS N4 ULC Ultra Light Client affected versions not specified Description: The issue concerns insecure communication using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients...