CVE-2026-14899

The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...

CVE-2026-13061

CVE-2026-13061 affects MongoDB: an authenticated user may access session metadata of other users via the $listSessions aggregation stage. Impacted data includes active session IDs, usernames, and activity timestamps, indicating an access-control weakness that ordinarily requires cluster‑level adm...

CVE-2026-13062

The CVE affects MongoDB with Queryable Encryption on sharded clusters. An authenticated user with write privileges on a Queryable Encryption-enabled collection can craft write commands routed via mongos to modify internal encryption metadata fields that should be server-controlled, leading to cor...

CVE-2026-13063

CVE-2026-13063 : An authenticated user with standard read/write privileges can trigger an OOM in MongoDB by sending a crafted aggregation command. The issue is attributed to the libmongocrypt library, which allegedly fails to properly validate payload-supplied values, potentially causing an exces...

CVE-2026-13064

CVE-2026-13064 affects MongoDB: certain query operations using deeply nested $jsonSchema constructs can cause disproportionate CPU consumption, leading to resource exhaustion on affected deployments. The root cause is described as CPU-bound operations that cannot be interrupted by standard admini...

CVE-2026-13065

CVE-2026-13065 : MongoDB contains a vulnerability in the aggregation framework where a user with read‑only privileges can craft a pipeline using the $linearFill window function with a particular sortBy expression, triggering abnormal mongod termination and a denial of service. The root cause is i...

CVE-2026-13066

CVE-2026-13066 affects MongoDB deployments that use server-side JavaScript. The root cause is improper handling of DBPointer objects during BSON serialization in the server’s JavaScript engine, which can cause internal process memory contents to be included in data returned to the client. The ava...

CVE-2026-13067

Technical details for CVE-2026-13067 are not publicly available in the provided documents; monitor for updates.

CVE-2026-13068

Summary: CVE-2026-13068 affects MongoDB mongos. An authenticated user with cursor-termination privileges on one database can terminate active cursors on a different database, disrupting ongoing queries for other users. The issue stems from an authorization check that does not properly scope privi...

CVE-2026-13069

An authenticated user can trigger resource exhaustion in MongoDB Server by sending a crafted Queryable Encryption (FLE2) find payload that uses an unvalidated field to drive an internal computation loop. This causes excessive CPU and potential out-of-memory, degrading availability for other opera...

CVE-2026-13070

The CVE affects MongoDB servers performing outbound TLS connections. A malformed OCSP response during the TLS handshake can cause the server to terminate abnormally, due to OCSP stapling validation enabled by default for outgoing connections. Impact is primarily availability (possible process ter...

CVE-2026-13071

CVE-2026-13071 affects MongoDB’s mongod process where an authenticated user with read access can trigger server-side JavaScript in certain aggregation expressions, exposing an improper memory handling flaw during document processing that can terminate the server. The issue is described across NVD...

CVE-2026-13072

The CVE applies to MongoDB when compute mode is enabled on a standalone mongod instance. The issue is insufficient validation of externally sourced BSON data during aggregation pipeline processing, which can lead to memory corruption and potentially cause the process to terminate or exhibit other...

CVE-2026-13073

The CVE describes an issue in MongoDB’s mongod where an authenticated user with read-only privileges can trigger abnormal termination via a crafted aggregation command. The root cause is an internal engine selection inconsistency caused by a specific combination of aggregation options, leading to...

CVE-2026-13074

Affected software: MongoDB server. Vulnerable component: the awaitable hello command in exhaust mode. Root cause: handling of a specific parameter combination leads to a response loop that bypasses normal throttling. Impact: unauthenticated remote clients can cause excessive CPU consumption and d...

CVE-2026-13075

The CVE-2026-13075 entry concerns MongoDB: an authenticated user can terminate the mongod process under memory pressure by triggering unbounded memory allocation in the error-suggestion path via the $rankFusion and $scoreFusion aggregation stages. Root cause is in the server’s error-handling path...

CVE-2026-13076

CVE-2026-13076 describes memory-exhaustion in MongoDB’s aggregation framework causing a mongod process termination under memory pressure. An authenticated user with write access and ability to run aggregation queries can trigger disproportionate memory consumption via a specific data type convers...

CVE-2026-13077

CVE-2026-13077 involves a missing bounds check in BSON CodeWScope element accessors, enabling an authenticated attacker to trigger an out-of-bounds heap read through a crafted aggregation pipeline. By generating malformed BSONColumn data containing a CodeWScope element, wire-level BSON validation...

CVE-2026-13078

Summary of technical details (CVE-2026-13078) : The vulnerability affects MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook. This hook allows JavaScript executed via the server to read arbitrary files from the host filesystem using the mon...

CVE-2026-22049

CVE-2026-22049 concerns ONTAP 9.16.1 and higher with WebAuthn MFA enabled. The vulnerability relates to the Relying Party ID and, when exploited by an attacker with valid credentials, could bypass MFA. Documented impact is high (full confidentiality, integrity, and availability concerns per CVSS)...