2026

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user wit

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges t

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with writ

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privilege

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal asse

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authoriz

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection c

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific typ

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cau

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled f

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store d

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert

A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer d

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a Mon

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controlle

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbCon

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. Th

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulner

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, s

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min,

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8,

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-ba

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A s

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launch

The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitizat

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. A

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authentic

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule th

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint,

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allow

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (t

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated co

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php a

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-s

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthent

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticat