168294 matches found
CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...
CVE-2026-64792 Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions
Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could...
CVE-2026-63281 Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager
Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries...
CVE-2026-64791 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or...
CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...
CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-alg$self-header-alg from the token's own header and then calls...
CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...
CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...
CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification
The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...
CVE-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error...
CVE-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...
CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...
CVE-2026-9737 Find command with $meta sort can lead to crash
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...
CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding
The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...
CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
CVE-2026-13063 libmongocrypt Improper Input Validation Leading to Process Termination
An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...
CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...
CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...
CVE-2026-13066 Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...
CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
CVE-2026-13068 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...
CVE-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...
CVE-2026-13070 Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...
CVE-2026-13071 Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...
CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default...
CVE-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...
CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...
CVE-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...
CVE-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...
CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-22049
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...
CVE-2026-16624 CVE-2026-16624
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...
CVE-2026-3482 IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request...
CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...
CVE-2026-64835 FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...
CVE-2026-65650
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...
CVE-2026-64834 FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...
CVE-2026-64833 FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...
CVE-2026-64832 FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ffnvdecstartframesepref error path frees...
CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...
CVE-2026-64830 FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...
CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...
CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...
CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...
CVE-2026-65011 Graylog2 Server Missing Permission Check on Event Definition Duplicate
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/definitionId/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private...
CVE-2026-16615 Librest: weak random number generation in pkce implementation
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
CVE-2026-46737
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...