Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-84465

Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same "validly signed" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zammad
Products
Zammad
CVE-2026-84460

Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zammad
Products
Zammad
CVE-2026-63207

Zammad: Sensitive Information Exposure in Integration Administration API

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zammad
Products
Zammad
CVE-2026-102809

PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-81522

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C\# Driver C\+\+ Driver
CVE-2026-81524

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-81525

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver Php Extension Php Library
CVE-2026-81526

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust-driver Rust Driver
CVE-2026-81527

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C# Driver C\# Driver
CVE-2026-81528

NoSQL injection via array replacement bypassing update shape validation in driver write path

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C# Driver C\# Driver
CVE-2026-81529

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C# Driver C\# Driver
CVE-2026-81530

KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C# Driver C\# Driver
CVE-2026-77184

MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-77586

MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-81490

MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-81517

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-81518

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-81520

MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-81019

wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfprovider
CVE-2026-81020

wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wolfssl
Products
Wolfengine