CVEs.

Latest CVEs

1. 8.8High

   CVE-2026-56167 ↗ (opens in a new tab)

   Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

   MAMicrosoft Azure· Jul 24, 2026

2. 9.9Crit

   CVE-2026-56160 ↗ (opens in a new tab)

   Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

   MAMicrosoft Azure· Jul 24, 2026

3. 7.2High

   CVE-2026-35425 ↗ (opens in a new tab)

   Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

   MAMicrosoft Azure· Jul 24, 2026

4. 5.3Med

   CVE-2026-21723 ↗ (opens in a new tab)

   The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

   GCGrafana Cloud· Jul 23, 2026

5. 7.1High

   CVE-2026-9737 ↗ (opens in a new tab)

   During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

   MAMongoDB Atlas· Jul 22, 2026

6. 8.4High

   CVE-2026-14881 ↗ (opens in a new tab)

   When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

   MAMongoDB Atlas· Jul 22, 2026

7. 6.3Med

   CVE-2026-13078 ↗ (opens in a new tab)

   A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

   MAMongoDB Atlas· Jul 22, 2026

8. 7.1High

   CVE-2026-13077 ↗ (opens in a new tab)

   A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

   MAMongoDB Atlas· Jul 22, 2026

9. 7.1High

   CVE-2026-13076 ↗ (opens in a new tab)

   An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

   MAMongoDB Atlas· Jul 22, 2026

10. 7.1High

    CVE-2026-13075 ↗ (opens in a new tab)

    An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

    MAMongoDB Atlas· Jul 22, 2026

11. 6.9Med

    CVE-2026-13074 ↗ (opens in a new tab)

    An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

    MAMongoDB Atlas· Jul 22, 2026

12. 5.3Med

    CVE-2026-13073 ↗ (opens in a new tab)

    An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

    MAMongoDB Atlas· Jul 22, 2026

13. 9.2Crit

    CVE-2026-13072 ↗ (opens in a new tab)

    When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

    MAMongoDB Atlas· Jul 22, 2026

14. 7.1High

    CVE-2026-13071 ↗ (opens in a new tab)

    An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

    MAMongoDB Atlas· Jul 22, 2026

15. 6.0Med

    CVE-2026-13070 ↗ (opens in a new tab)

    A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.

    MAMongoDB Atlas· Jul 22, 2026

16. 7.1High

    CVE-2026-13069 ↗ (opens in a new tab)

    An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

    MAMongoDB Atlas· Jul 22, 2026

17. 2.3Low

    CVE-2026-13068 ↗ (opens in a new tab)

    An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

    MAMongoDB Atlas· Jul 22, 2026

18. 7.2High

    CVE-2026-13067 ↗ (opens in a new tab)

    When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

    MAMongoDB Atlas· Jul 22, 2026

19. 7.1High

    CVE-2026-13066 ↗ (opens in a new tab)

    Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

    MAMongoDB Atlas· Jul 22, 2026

20. 7.1High

    CVE-2026-13065 ↗ (opens in a new tab)

    A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

    MAMongoDB Atlas· Jul 22, 2026

21. 7.1High

    CVE-2026-13064 ↗ (opens in a new tab)

    Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

    MAMongoDB Atlas· Jul 22, 2026

22. 5.3Med

    CVE-2026-13063 ↗ (opens in a new tab)

    An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

    MAMongoDB Atlas· Jul 22, 2026

23. 7.1High

    CVE-2026-13062 ↗ (opens in a new tab)

    An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

    MAMongoDB Atlas· Jul 22, 2026

24. 5.3Med

    CVE-2026-13061 ↗ (opens in a new tab)

    An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

    MAMongoDB Atlas· Jul 22, 2026

25. 7.1High

    CVE-2026-13060 ↗ (opens in a new tab)

    An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

    MAMongoDB Atlas· Jul 22, 2026

26. 8.6High

    CVE-2026-13059 ↗ (opens in a new tab)

    An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

    MAMongoDB Atlas· Jul 22, 2026

27. 7.1High

    CVE-2026-13058 ↗ (opens in a new tab)

    An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

    MAMongoDB Atlas· Jul 22, 2026

28. 6.0Med

    CVE-2026-13057 ↗ (opens in a new tab)

    An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

    MAMongoDB Atlas· Jul 22, 2026

29. 7.1High

    CVE-2026-13056 ↗ (opens in a new tab)

    Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

    MAMongoDB Atlas· Jul 22, 2026

30. 7.1High

    CVE-2026-13055 ↗ (opens in a new tab)

    The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

    MAMongoDB Atlas· Jul 22, 2026

31. 6.5Med

    CVE-2026-63263 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

    ECElastic Cloud· Jul 22, 2026

32. 4.3Med

    CVE-2026-63262 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

    ECElastic Cloud· Jul 22, 2026

33. 6.5Med

    CVE-2026-63261 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

    ECElastic Cloud· Jul 21, 2026

34. 6.5Med

    CVE-2026-63260 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.

    ECElastic Cloud· Jul 21, 2026

35. 4.3Med

    CVE-2026-63259 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

    ECElastic Cloud· Jul 21, 2026

36. 4.3Med

    CVE-2026-63145 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machin

    ECElastic Cloud· Jul 21, 2026

37. 6.5Med

    CVE-2026-63144 ↗ (opens in a new tab)

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

    ECElastic Cloud· Jul 21, 2026

38. 4.3Med

    CVE-2026-63143 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

    ECElastic Cloud· Jul 21, 2026

39. 5.0Med

    CVE-2026-63142 ↗ (opens in a new tab)

    Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.

    ECElastic Cloud· Jul 21, 2026

40. 5.4Med

    CVE-2026-63141 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

    ECElastic Cloud· Jul 21, 2026

41. 8.7High

    CVE-2026-64881 ↗ (opens in a new tab)

    The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

    TETenable· Jul 21, 2026

42. 6.5Med

    CVE-2026-63140 ↗ (opens in a new tab)

    Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully

    ECElastic Cloud· Jul 21, 2026

43. 6.5Med

    CVE-2026-63139 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.

    ECElastic Cloud· Jul 21, 2026

44. 6.5Med

    CVE-2026-63136 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

    ECElastic Cloud· Jul 21, 2026

45. 7.1High

    CVE-2026-56147 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of,

    ECElastic Cloud· Jul 21, 2026

46. 7.1High

    CVE-2026-64880 ↗ (opens in a new tab)

    Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.

    TETenable· Jul 21, 2026

47. 9.4Crit

    CVE-2026-64879 ↗ (opens in a new tab)

    A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

    TETenable· Jul 21, 2026

48. 9.4Crit

    CVE-2026-64878 ↗ (opens in a new tab)

    Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

    TETenable· Jul 21, 2026

49. 5.4Med

    CVE-2026-56146 ↗ (opens in a new tab)

    Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.

    ECElastic Cloud· Jul 21, 2026

50. 6.5Med

    CVE-2026-56145 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.

    ECElastic Cloud· Jul 21, 2026