2026

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write pat

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding i

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace ide

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embed

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserv

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public shar

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisio

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows networ

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor reso

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulne

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue c

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allow

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu ent

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, conc

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When de

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report T

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing th

RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values w

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When usi

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response split

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Ev

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choos

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stre

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Clou

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cl

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Fu

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Func

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Sp

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cl

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Functi

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without strippin

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks m

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdi

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Sprin

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-sup

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacke

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Sp

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Inte

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spri

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commo

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable