Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
During query planning, MongoDB does not correctly handle the `$meta` expression when processing sort patterns in raw BSON object form. This leads to incorrect transformations that can trigger an invariant failure and ...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7
Directory traversal file overwrite in OpenStack Ironic ISO handling (CVE-2026-48681)
A vulnerability in OpenStack Ironic's ISO handling code allows a maliciously crafted ISO image to cause path traversal, enabling arbitrary file overwrite on the Ironic conductor's disk. In the anaconda deploy interfac...
Fixed in 26.1.7; 29.0.6; 32.0.2; 35.0.2
Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can cause internal process memory contents to be included in data returned to the client. This constitutes an...
Fixed in 7.0.39; 8.0.28; 8.2.12; 8.3.7; 9.0.0-rc1; 9.1.0-rc0
Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
A read-only user can craft an aggregation pipeline using the $linearFill window function operator with an expression-based sortBy expression to cause the mongod process to terminate abnormally. This results in a denia...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
A flaw in MongoDB's query planning code causes hashing of query solutions involving deeply nested `$jsonSchema` constructs (specifically `InternalSchema*` match expressions) to exhibit exponential time complexity rath...
Fixed in 9.0.0-rc0; 8.2.12; 8.0.28; 8.3.7
Memory exhaustion via QPACK trailer expansion in quic-go HTTP/3 (CVE-2026-40898)
quic-go's HTTP/3 client and server implementations enforce size limits on the QPACK-compressed HEADERS frame but not on the decoded trailer field section, allowing a malicious peer to send a crafted HEADERS frame that...
Fixed in v0.59.1
Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
An inconsistency between MongoDB's authorization and execution phases of the `$graphLookup` aggregation stage allows an authenticated user with limited read privileges to access documents from collections they are not...
Fixed in 9.0.0-rc0; 8.3.7; 8.2.12; 8.0.28; 7.0.39
CSV injection and reflected XSS in HCL iControl (CVE-2025-52612)
HCL iControl contains a CSV injection vulnerability in its Export CSV functionality, combined with a reflected cross-site scripting (XSS) vulnerability, both caused by insufficient sanitization of input parameters. A ...
Fixed in v4.2.0
Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)
An authenticated MongoDB user can crash a mongod server by submitting an aggregation pipeline containing the `$_internalIndexKey` expression with a compound wildcard index specification. The expression fails to handle...
Fixed in 8.2.11; 8.2.12; 8.0.28; 7.0.39; 8.3.7
Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)
An authenticated user with basic write privileges can send a `startOrContinueTransaction` command without the required `autocommit` field, triggering a fatal internal invariant failure in `initializeOperationSessionIn...
Fixed in 8.2.11; 8.2.12; 8.0.28; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
Heap buffer overflow in List::SomeUtils::XS pairwise function (CVE-2026-12844)
List::SomeUtils::XS before version 0.59 for Perl contains a heap-based buffer overflow in the pairwise() function. The buffer growth logic uses a single quadrupling operation rather than a loop, allowing a block that ...
Fixed in 0.59
Use-after-free in FreeBSD sound(4) driver mmap path (CVE-2026-49417)
The FreeBSD sound(4) driver contains a use-after-free vulnerability in its mmap(2) support. When a mapped audio device is closed, the underlying audio buffer can be freed while the mapping remains valid, allowing the ...
Fixed in 15.1-RC3-p1; 15.0-RELEASE-p10; 14.4-RELEASE-p6; 14.3-RELEASE-p15
Privilege escalation via LD_PRELOAD injection in FreeBSD Linuxulator (CVE-2026-49413)
The FreeBSD Linuxulator incorrectly set AT_SECURE to zero in the ELF auxiliary vector for set-user-ID and set-group-ID Linux binaries because it checked the P_SUGID process flag before that flag is set during execve(2...
Fixed in 15.1-RC3-p1; 15.0-RELEASE-p10; 14.4-RELEASE-p6; 14.3-RELEASE-p15
NULL pointer dereference in JavaScript::Minifier::XS for Perl (CVE-2026-56017)
JavaScript::Minifier::XS before version 0.16 for Perl crashes with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp/division disambiguator in JsTokenizeString walks back o...
Fixed in 0.16
Uncontrolled recursion and O(N²) memory exhaustion in Net::BitTorrent (CVE-2026-57081)
The bencode decoder in Net::BitTorrent recurses once per nested list or dictionary level with no depth cap, and each recursive frame retains its own copy of the remaining buffer, resulting in O(N²) peak memory consump...
Fixed in v2.1.0
Unbounded BPF probe replay loop causes CPU exhaustion in OBI (CVE-2026-45680)
OBI (go.opentelemetry.io/obi) replays BPF probe hits into histogram observations by iterating once per recorded run-count delta during each metrics collection interval. On busy systems, an uncapped delta between scrap...
Fixed in v0.9.0
Heap memory disclosure via type confusion in HTML::Gumbo for Perl (CVE-2025-15646)
HTML::Gumbo before version 0.19 fails to handle the `<template>` HTML element in its `walk_tree` function, treating it as a text node and causing `strlen()` to over-read a heap buffer. Callers using `parse()` with `fo...
Fixed in 0.19
Unauthorized fork synchronization after visibility change in Gitea (CVE-2026-24451)
The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint in Gitea fails to enforce visibility restrictions when a parent repository is changed from public to private. A fork owner who no longer has access to th...
Fixed in 1.26.3
Unauthorized access to labels of private organizations in Gitea (CVE-2026-25038)
Gitea 1.26.2 does not properly enforce organization visibility restrictions on the organization label read endpoints. An unauthorized user - one without membership in a private organization - can retrieve that organiz...
Fixed in 1.26.3
Biased DSA nonce/private-key generation in Crypt::DSA for Perl (CVE-2026-14570)
Crypt::DSA versions before 1.22 for Perl derive the DSA signing nonce and private key from a biased random generator (`Crypt::DSA::Util::makerandom`), which forces the high bit of every returned value, making the outp...
Fixed in 1.22