Open Source Vulnerabilities

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

mongodb, mongodb, mongodb, mongodb

InstantCMS has Remote Code Execution in package installer

org.thymeleaf.extras:thymeleaf-extras-springsecurity5, org.thymeleaf.extras:thymeleaf-extras-springsecurity6, org.thymeleaf.testing:thymeleaf-testing, org.thymeleaf.testing:thymeleaf-testing-lib, org.thymeleaf.testing:thymeleaf-testing-spring5, org.thymeleaf.testing:thymeleaf-testing-spring6, org.thymeleaf:thymeleaf-lib, org.thymeleaf:thymeleaf-parent, org.thymeleaf:thymeleaf-spring5, org.thymeleaf:thymeleaf-spring6

TuxCare security update for 10 packages (1 CVE)

aircheng-org iWebShop-5 systemseller.php login improper authentication

Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion

vim

vim vulnerability

grafana-cloudmonitoring-datasource

jinja2

TuxCare security update for jinja2 (2 CVEs)

scikit-learn

TuxCare security update for scikit-learn (1 CVE)

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

ffmpeg

ffmpeg vulnerabilities

DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

nltk

NLTK: Corpus Reader Sandbox Bypass

nltk

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

govulncheck-vulndb

Security update for govulncheck-vulndb

Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

grafana-clickhouse-datasource

aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

nltk

NLTK: Allowlisted pickle loaders still permit code execution in current source

AshLua eval read operations can read field-policy-protected fields via aggregates

ash_lua,

AshLua eval read operations can read field-policy-protected fields via aggregates

nltk

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

AshAi aggregate tool can read field-policy-protected fields

ash_ai,

AshAi aggregate tool can read field-policy-protected fields

nltk

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

nltk

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

nltk

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

nltk

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

nltk

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

multipath-tools

Security update for multipath-tools

libzypp, zypper

Security update for libzypp, zypper

aircheng-org iWebShop-5 member.php member_list sql injection

Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service