Tagged “cve.org”
CVEs tagged cve.org, newest first.
47404 CVEsRSS
CVE-2026-114654Medium· 6.5PoCBSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such …
CVE-2026-114653Medium· 6.5PoCSilent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an…
CVE-2026-114648High· 7.6PoCNoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user wh…
CVE-2026-114647Medium· 4.3PoCNoSQL operator injection via unvalidated replacement document in findOneAndReplace
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field n…
CVE-2026-114646Medium· 6.5PoCNoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify…
CVE-2026-114644Medium· 5.9PoCMemory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived …
CVE-2026-114643Medium· 5.4PoCDuplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can…
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch …
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return…
CVE-2026-115221Medium· 5.4Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by mat…
CVE-2026-115424Medium· 5.5Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of …
CVE-2026-114583Medium· 6.9tar filter allows writing outside destination via empty-named symlink
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to …
CVE-2026-114625Critical· 9.9CISA KEV0dayPoCSecurity Advisory 0199
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integ…
CVE-2026-114649Medium· 6.8PoCAuthentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users,…
CVE-2026-114645Medium· 5.2Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection con…
CVE-2026-114655Medium· 5.9KMS request injection via unsanitized key vault and provider values in libmongocrypt
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies witho…
CVE-2026-114652Medium· 6.5PoCUpdate operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application …
CVE-2026-114651Medium· 4.0PoCCross-document data leak via malformed BSON array parsing in reused thread buffer
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated par…
CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the und…
CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attack…
CVE-2026-115417High· 7.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users shou…
CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-79847Critical· 10.0Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results…
CVE-2026-79844Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-10
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met.…
CVE-2026-115419High· 8.1Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could rea…
CVE-2026-113582High· 7.5Apache Abdera: XML external entity expansion in Atom document parsing
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. …
CVE-2026-115505High· 7.6PoClibsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send craf…
CVE-2026-112331High· 7.5Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type…
CVE-2026-112330High· 7.5Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can su…