CVEs.

Matching CVEs

1. 8.7High

   CVE-2026-120828 ↗ (opens in a new tab)

   A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.

   MAMongoDB Atlas· Nov 10, 2026

2. 7.1High

   CVE-2026-120826 ↗ (opens in a new tab)

   An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

   MAMongoDB Atlas· Nov 10, 2026

3. 7.1High

   CVE-2026-120825 ↗ (opens in a new tab)

   An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

   MAMongoDB Atlas· Nov 10, 2026

4. 8.7High

   CVE-2026-120824 ↗ (opens in a new tab)

   A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

   MAMongoDB Atlas· Nov 10, 2026

5. 8.6High

   CVE-2026-120822 ↗ (opens in a new tab)

   MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

   MAMongoDB Atlas· Nov 10, 2026

6. 7.1High

   CVE-2026-120821 ↗ (opens in a new tab)

   A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

   MAMongoDB Atlas· Nov 10, 2026

7. 7.1High

   CVE-2026-120818 ↗ (opens in a new tab)

   A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server

   MAMongoDB Atlas· Nov 10, 2026

8. 7.1High

   CVE-2026-120817 ↗ (opens in a new tab)

   A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

   MAMongoDB Atlas· Nov 10, 2026

9. 8.6High

   CVE-2026-120815 ↗ (opens in a new tab)

   An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

   MAMongoDB Atlas· Nov 10, 2026

10. 7.5High

    CVE-2026-120814 ↗ (opens in a new tab)

    An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data

    MAMongoDB Atlas· Nov 10, 2026

11. 8.2High

    CVE-2026-120813 ↗ (opens in a new tab)

    An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.

    MAMongoDB Atlas· Nov 10, 2026

12. 7.1High

    CVE-2026-120810 ↗ (opens in a new tab)

    An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’

    MAMongoDB Atlas· Nov 10, 2026

13. 7.5High

    CVE-2026-120807 ↗ (opens in a new tab)

    A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession o

    MAMongoDB Atlas· Nov 10, 2026

14. 7.0High

    CVE-2026-120806 ↗ (opens in a new tab)

    A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges o

    MAMongoDB Atlas· Nov 10, 2026

15. 8.2High

    CVE-2026-120804 ↗ (opens in a new tab)

    A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.

    MAMongoDB Atlas· Nov 10, 2026

16. 7.1High

    CVE-2026-120803 ↗ (opens in a new tab)

    A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific

    MAMongoDB Atlas· Nov 10, 2026

17. 7.7High

    CVE-2026-115539 ↗ (opens in a new tab)

    SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager.

    DODocker· Nov 10, 2026

18. 7.0High

    CVE-2026-115538 ↗ (opens in a new tab)

    Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats t

    DODocker· Nov 10, 2026

19. 8.1High

    CVE-2026-108187 ↗ (opens in a new tab)

    Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

    ZOZoom· Nov 10, 2026

20. 8.7High

    CVE-2026-12708 ↗ (opens in a new tab)

    Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound. Impact Exploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role

    CLCloudflare· Nov 10, 2026

21. 8.5High

    CVE-2026-33379 ↗ (opens in a new tab)

    A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

    GCGrafana Cloud· Nov 6, 2026

22. 7.7High

    CVE-2026-104608 ↗ (opens in a new tab)

    A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior

    GIGitHub· Nov 3, 2026

23. 7.1High

    CVE-2026-121614 ↗ (opens in a new tab)

    Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbo

    DODocker· Nov 3, 2026

24. 7.3High

    CVE-2026-93325 ↗ (opens in a new tab)

    Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.

    DODocker· Nov 3, 2026

25. 7.1High

    CVE-2026-120956 ↗ (opens in a new tab)

    The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

    MAMongoDB Atlas· Nov 3, 2026

26. 8.7High

    CVE-2026-120955 ↗ (opens in a new tab)

    The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

    MAMongoDB Atlas· Nov 3, 2026

27. 8.7High

    CVE-2026-120678 ↗ (opens in a new tab)

    A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

    MAMongoDB Atlas· Nov 3, 2026

28. 7.4High

    CVE-2026-115714 ↗ (opens in a new tab)

    Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protect

    ECElastic Cloud· Nov 3, 2026

29. 7.3High

    CVE-2026-115294 ↗ (opens in a new tab)

    Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.

    ECElastic Cloud· Nov 3, 2026

30. 7.5High

    CVE-2026-115290 ↗ (opens in a new tab)

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

    ECElastic Cloud· Nov 3, 2026

31. 8.4High

    CVE-2026-103916 ↗ (opens in a new tab)

    Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

    DODocker· Nov 3, 2026

32. 7.0High

    CVE-2026-65168 ↗ (opens in a new tab)

    NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

    NVNVIDIA· Nov 3, 2026

33. 8.3High

    CVE-2026-119179 ↗ (opens in a new tab)

    A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

    MAMongoDB Atlas· Nov 3, 2026

34. 8.7High

    CVE-2026-120091 ↗ (opens in a new tab)

    Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. Create

    TCTemporal Cloud· Nov 2, 2026

35. 7.7High

    CVE-2026-81938 ↗ (opens in a new tab)

    Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and conf

    GCGrafana Cloud· Nov 2, 2026

36. 8.1High

    CVE-2026-119977 ↗ (opens in a new tab)Known exploited

    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

    WCWordPress.com (Automattic)· Oct 31, 2026

37. 8.7High

    CVE-2026-13303 ↗ (opens in a new tab)

    HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

38. 8.8High

    CVE-2026-119168 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

39. 8.4High

    CVE-2026-107347 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

40. 7.5High

    CVE-2026-115713 ↗ (opens in a new tab)

    Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).

    ECElastic Cloud· Oct 29, 2026

41. 8.2High

    CVE-2026-115709 ↗ (opens in a new tab)

    Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

    ECElastic Cloud· Oct 29, 2026

42. 7.2High

    CVE-2026-115708 ↗ (opens in a new tab)

    Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

    ECElastic Cloud· Oct 29, 2026

43. 8.0High

    CVE-2026-93851 ↗ (opens in a new tab)

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742

    MCMattermost Cloud· Oct 28, 2026

44. 7.6High

    CVE-2026-116641 ↗ (opens in a new tab)

    The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

    MAMongoDB Atlas· Oct 28, 2026

45. 7.7High

    CVE-2026-88967 ↗ (opens in a new tab)

    A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

    GCGrafana Cloud· Oct 28, 2026

46. 7.7High

    CVE-2026-118510 ↗ (opens in a new tab)

    A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

    MAMongoDB Atlas· Oct 28, 2026

47. 8.9High

    CVE-2026-103506 ↗ (opens in a new tab)

    An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

    GCGrafana Cloud· Oct 28, 2026

48. 7.7High

    CVE-2026-100105 ↗ (opens in a new tab)

    A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

    GCGrafana Cloud· Oct 28, 2026

49. 7.8High

    CVE-2026-113775 ↗ (opens in a new tab)

    A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.

    AUAutodesk· Oct 27, 2026

50. 7.1High

    CVE-2026-102638 ↗ (opens in a new tab)

    A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

    AUAutodesk· Oct 27, 2026