2026

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafte

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation express

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP respons

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a c

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be v

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result i

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-mem

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessi

An authenticated user with limited read privileges may be able to access documents from collections they are not authori

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a craf

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate object

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod)

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2,  6.2.1.0 through 6.2.1.1_2, and  6.

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnera

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within l

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtp

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attacker

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavc

Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. In

Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CM

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows a

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_fo

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{de

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder tha

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allo

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API,

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attac

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnera

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauth

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A hig

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allow

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allow

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in Image

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Info

The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zon

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for on