Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

151-75% vs 7-day avg of 598

2 critical, 41 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.6	CVE-2026-115929	MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store electron, MongoDB, Inc.electron, MongoDB, Inc. MongoDB Compass	NVD	Oct 24 01:17 UTC
CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store Executive summary The advisory concerns MongoDB Compass, a desktop tool for MongoDB, whose TLS root certificate store comes from the bundled Electron runtime. The release notes say the issue was addressed by updating Electron, and the advisory does not state how severe the flaw is. The recommended action in the text is to use MongoDB Compass v1.53.1, which includes the updated Electron. Technical summary The advisory describes the flaw as a problem in Electron's own TLS root certificate store, which MongoDB Compass relies on. The vulnerability class, CVSS score, and attack vector are not stated. The fix is an Electron update included in MongoDB Compass 1.53.1, with the Electron v44.9.1 release notes cited as the reference for CVE-2026-115929. The affected Compass versions before 1.53.1 are not explicitly stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb-js/compass/releases/tag/v1.53.1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects electron MongoDB, Inc.electron MongoDB, Inc. MongoDB Compass NIST National Vulnerability DatabasePublished Oct 24, 2026 01:17 UTC Read the advisory
	Medium	6.0	CVE-2026-114655	libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS... MongoDB, Inc., libmongocryptMongoDB, Inc. libmongocrypt, libmongocrypt	NVD	Oct 22 19:17 UTC
CVE-2026-114655libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS... Executive summary A flaw in libmongocrypt, a library used to encrypt data with external key management services, lets a user with write access to the key vault collection alter requests sent to AWS, Azure and GCP key services. The advisory rates it Moderate with a CVSS v3.1 base score of 5.9 and recommends upgrading to version 1.21.1. Technical summary The weakness is CWE-74, improper neutralization of special elements in output used by a downstream component (injection). libmongocrypt inserts values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them, so a user with write access to the key vault collection can add members to request bodies and token claims that the library signs with the application's credentials. Affected versions are stated as >= 1.0.0, < 1.21.1, and the patched version is 1.21.1. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/libmongocrypt/securi…/GHSA-7mvq-mg47-m88j Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.libmongocrypt MongoDB, Inc. libmongocrypt libmongocrypt NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-114654	A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114654A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to... Executive summary The MongoDB C# Driver, a library used by .NET applications to talk to MongoDB databases, has a flaw that lets an out-of-range binary subtype value supplied through untrusted text input corrupt BSON output. The advisory does not state a severity rating. The fix is in driver release 3.13.0, and the advisory says users should review the behavior changes listed under each security fix before upgrading. Technical summary The flaw is a numeric-type conversion error in the BSON handling library that lets an out-of-range binary subtype value, supplied through untrusted textual input, corrupt BSON output and bypass UUID and OldBinary guards. The advisory's release notes describe it as CSHARP-6166 / CVE-2026-114654 and say the fix makes BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer reject binary subtypes outside 0 to 255. The affected version range is not stated in the text provided, and the advisory states the fixed version as 3.13.0. The advisory does not describe a workaround, detection guidance, or exploitation in the wild, and the attack preconditions beyond untrusted textual input are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-114653	A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114653A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern... Executive summary A flaw in the MongoDB C# Driver's client-side field-level encryption schema builder can cause some fields to be silently left unencrypted. The advisory does not state a severity rating or CVSS score. The advisory points to the 3.13.0 driver release, whose notes describe the fix, and asks users to review the listed behavior changes before upgrading. Technical summary The weakness is an unescaped regular expression: caller-supplied field names passed to the CSFLE schema builder's PatternProperty are interpreted as patterns, which can silently bypass client-side encryption. The advisory does not state the attack vector, required privileges, or preconditions. Affected version numbers are not stated, though the release notes for the 3.13.0 driver list this as a security fix. The fix matches field names both as literal names and as regular expressions, and the PatternProperty overload that takes a field expression is marked obsolete in favor of Property. No workaround is stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-114652	A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114652A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as... Executive summary The advisory covers CVE-2026-114652, a data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver, where application-supplied values can be interpreted as update operators. The release notes for MongoDB C# Driver 3.13.0 list this as a security fix and note a behavior change in how single-value update builders render their output. The advisory does not state a severity score, and the vendor's recommendation is to review the listed behavior changes before upgrading. Technical summary The weakness is an update operator injection (CWE-style neutralization flaw) in the update builder of the MongoDB C# Driver, tracked as CSHARP-6168. The advisory text does not state the attack vector, required privileges, or preconditions, and it does not state a CVSS score. The affected version range is not explicitly stated in the excerpt, although the notes describe the fix as part of the 3.13.0 general availability release. The fix in 3.13.0 changes PushEach and AddToSetEach with a single value to always render $each, and PullAll with a single value to always render $pullAll, where previously a single value was unwrapped or rendered as $pull. No workaround and no detection guidance are stated in the excerpt, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	6.3	CVE-2026-114651	A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver, MongoDB, Inc. .NET Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114651A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when... Executive summary The advisory concerns CVE-2026-114651 in the MongoDB C# Driver, a component of MongoDB's .NET software. The flaw is a memory-handling weakness in the BSON deserialization component that may return leftover data from previously processed content. The advisory does not state a severity rating, and the fix is included in the 3.13.0 driver release, which the advisory says users should review before upgrading. Technical summary The weakness is described as a memory-handling issue in the BSON deserialization component, where data left over from previously processed content may be returned. Per the release notes, the issue is a cross-document data leak via malformed BSON array parsing in a reused thread buffer, tracked as CSHARP-6170. The attack vector, required privileges, and user interaction are not stated. The fixed version is stated as the 3.13.0 general availability release of the .NET driver, but affected version ranges are not stated. No workaround and no detection guidance are stated, and whether the issue has been exploited in the wild is not stated. No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver MongoDB, Inc. .NET Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-114650	A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver, MongoDB, Inc. libmongocrypt, MongoDB, Inc. MongoDB.Libmongocrypt NuGet package, MongoDB, Inc. .NET/C# driver	NVD	Oct 22 19:17 UTC
CVE-2026-114650A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption Executive summary The advisory describes a flaw in the client-side encryption support of the MongoDB .NET/C# driver that can cause data meant for client-side field-level encryption to be written without encryption. It is fixed in the 3.13.0 release of the driver, which also addresses several other CVEs. The advisory does not state a severity rating, and the recommended action is to upgrade to version 3.13.0 after reviewing the listed behavior changes. Technical summary The CVE-2026-114650 item (CSHARP-6180) is described as plaintext exposure of encrypted fields caused by ANSI code-page corruption of the database name, which made databases with non-ASCII names fail to match schema map namespaces. The fix changes automatic encryption to pass the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page. The advisory does not state the attack vector, required privileges, or exploitation status. It does not give a CVSS score, and it does not state a workaround or detection guidance beyond upgrading to 3.13.0 and reviewing the behavior changes. The advisory lists the fixed release as 3.13.0 and does not name the affected version range for this specific CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver MongoDB, Inc. libmongocrypt MongoDB, Inc. MongoDB.Libmongocrypt NuGet package MongoDB, Inc. .NET/C# driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.6	CVE-2026-114649	The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections Executive summary The advisory covers CVE-2026-114649 in the MongoDB C# Driver, where client TLS certificates are compared only by issuer and serial number when deciding whether two clients can share cached cluster connections. The advisory describes this as an authentication bypass. It is fixed in the 3.13.0 general availability release of the driver, and the vendor advises reviewing the listed behavior changes before upgrading. Technical summary The flaw is an authentication bypass caused by certificate equality checks that use only the issuer and serial number when deciding whether clients can share a cached cluster. The fix in 3.13.0 changes SslSettings to compare the full certificate by SHA-256 hash and whether a private key is present. The advisory does not state the attack vector, the preconditions an attacker needs, or the affected driver versions before 3.13.0. Affected version ranges, workarounds, exploitation status, CVSS score, and detection guidance are not stated. Upgrading to 3.13.0 is the only remediation the advisory describes. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	7.2	CVE-2026-114648	The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into... Executive summary The MongoDB C# Driver, a library developers use to connect .NET applications to MongoDB databases, has a flaw in how it handles dot and dollar characters in LINQ query field names, dictionary keys, and array-filter identifiers. The advisory ties this to CVE-2026-114648, which it describes as query redirection through unvalidated string keys. The advisory does not state a severity score, and the fix is version 3.13.0 of the driver, which changes LINQ translation to reject affected names. Technical summary The weakness is a failure to neutralize dot and dollar characters in field names used in LINQ queries, which the advisory calls query redirection via unvalidated string keys spliced into filter field paths. The advisory does not state the attack vector, the privileges or preconditions required, or whether exploitation has occurred. The fix is in driver release 3.13.0 (CSHARP-6181), where LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names containing ".", names starting with "$" at the start of a path, and positional operators. The advisory does not state any workaround for earlier versions, and it provides no detection guidance. Users should review the behavior changes listed in the release notes before upgrading. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-114647	The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114647The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations Executive summary The MongoDB C# Driver, in its 3.13.0 release, is affected by a flaw in which FindOneAndReplace does not reject replacement documents whose first top-level field name starts with a dollar sign, which could enable NoSQL operator injection. The advisory does not state a severity rating or a CVSS score. The release notes say the fix is to upgrade to driver version 3.13.0, where FindOneAndReplace now throws an error in this case, and users should review the listed behavior changes before upgrading. Technical summary The weakness is NoSQL operator injection (CVE-2026-114647, tracked as CSHARP-6186) caused by unvalidated replacement documents in FindOneAndReplace, which is described as inconsistent with other replace operations that already reject such documents. The advisory does not state the attack vector, required privileges, or preconditions. The fixed behavior is that FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, matching ReplaceOne. The advisory names 3.13.0 as the release containing the fix, but it does not state the affected version range or the vulnerable versions before that release. No workarounds and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-114646	A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114646A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver Executive summary The advisory describes a set of security fixes in the MongoDB C# Driver, released as version 3.13.0, which addresses several CVEs including CVE-2026-114646. The fixes cover injection, denial of service, data leakage, and encryption and authentication bypass issues, and the advisory does not state an overall severity rating. The vendor recommends upgrading to 3.13.0 and reviewing the listed behavior changes before doing so. Technical summary CVE-2026-114646 (CSHARP-6157) is described as NoSQL command injection caused by a mismatched raw BSON length prefix written verbatim to the wire. The fix makes writing a raw BSON document or array throw ArgumentException when its declared length is inconsistent with the buffer, and bytes past the declared length are ignored. The advisory does not state the attack vector, required privileges, or any workaround. The advisory does not state a CVSS score or whether the issue is exploited in the wild, and no detection guidance is given beyond the upgrade and behavior change notes. The fixed version is stated as 3.13.0 (the general availability release), and the advisory does not state which earlier versions are affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.7	CVE-2026-114645	A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively... MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114645A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively... Executive summary A flaw in the MongoDB C Driver affects only Windows client builds that use the Windows-native authentication backend. The advisory rates it Moderate, with a CVSS 3.1 base score of 5.2, and says it can corrupt client process memory and crash the client application. The vendor's recommendation is to upgrade to patched versions 1.30.14 or 2.5.7. Technical summary The flaw is a 32-bit integer wraparound (CWE-190) in the Windows-only Kerberos/SSPI authentication code, which can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client connection configuration, leading to a heap overflow. The advisory's CVSS vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H, so exploitation requires local access, high complexity, high privileges, and control over the client-side configuration. Affected versions are >= 1.6.0 and < 1.30.14, and >= 2.0.0 and < 2.5.7; patched versions are 1.30.14 and 2.5.7. The advisory does not state any workaround, and it provides no detection guidance. It also does not state whether the issue has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-c-driver/secur…/GHSA-g9mw-2cwh-6hh9 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	8.2	CVE-2026-114644	The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114644The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type Executive summary The MongoDB C# Driver's BSON library contains a flaw that lets resource consumption grow without limit when it deserializes one BSON value type, which can exhaust memory and cause a denial of service. The advisory does not state a severity score. The fix is in the 3.13.0 release of the driver, and the advisory points users to review its behavior changes before upgrading. Technical summary The weakness is classified as uncontrolled resource consumption, specifically memory exhaustion from unbounded symbol interning during BSON and JSON deserialization of BsonSymbol values (tracked as CSHARP-6162). The advisory does not state the attack vector, the exact preconditions, or whether authentication is required. The affected version range is not stated, but the 3.13.0 general availability release notes list this fix. The fix stops interning BsonSymbol values and marks BsonSymbolTable obsolete, and users should use BsonSymbol.Create or implicit string conversion instead. The advisory does not state a workaround, a CVSS score, known exploitation in the wild, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-114643	The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver	NVD	Oct 22 19:17 UTC
CVE-2026-114643The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates Executive summary The MongoDB C# Driver, in its 3.13.0 release, has a security flaw where GeoJSON extra members are written without checking whether their names collide with reserved GeoJSON members such as type and coordinates. The advisory does not state a severity rating or a CVSS score. The release notes say the fix is to upgrade to driver version 3.13.0, where GeoJSON serialization now throws an error when an extra member has the same name as a declared member. Technical summary The weakness is a duplicate-key BSON injection through GeoJSON extra members, tracked as CSHARP-6179 and CVE-2026-114643, which can override geometry values. The release notes describe the behavior change as GeoJSON serialization throwing BsonSerializationException when an extra member shares a name with a declared member, and this is the fix in driver 3.13.0. The advisory does not state the attack vector, the preconditions an attacker needs, or the affected driver versions before 3.13.0. It does not state a workaround or any detection guidance. The advisory does not state whether exploitation has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory
	High	8.6	CVE-2026-113870	MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source MongoDB, Inc.MongoDB, Inc. MongoDB Compass	NVD	Oct 21 19:17 UTC
CVE-2026-113870MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source From the advisory MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Compass NIST National Vulnerability DatabasePublished Oct 21, 2026 19:17 UTC Read the advisory
	High	8.2	CVE-2026-112368	An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the... MongoDB, Inc.MongoDB, Inc. PHP Driver	NVD	Oct 19 16:17 UTC
CVE-2026-112368An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the... From the advisory An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. PHP Driver NIST National Vulnerability DatabasePublished Oct 19, 2026 16:17 UTC Read the advisory
	High	7.1	CVE-2026-96299	A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting... MongoDB, Inc.MongoDB, Inc. MongoDB Server	NVD	Oct 13 16:17 UTC
CVE-2026-96299A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting... From the advisory A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Server NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	Medium	6.0	CVE-2026-96297	Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released MongoDB, Inc.MongoDB, Inc. MongoDB Server	NVD	Oct 13 16:17 UTC
CVE-2026-96297Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released From the advisory Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Server NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	High	7.1	CVE-2026-104005	A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting... MongoDB, Inc.MongoDB, Inc. MongoDB Server	NVD	Oct 13 16:17 UTC
CVE-2026-104005A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting... From the advisory A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Server NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	High	7.1	CVE-2026-104004	MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator MongoDB, Inc.MongoDB, Inc. MongoDB Server	NVD	Oct 13 16:17 UTC
CVE-2026-104004MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator From the advisory MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Server NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	Medium	5.3	CVE-2026-103965	An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting MongoDB, Inc.MongoDB, Inc. MongoDB Server	NVD	Oct 13 16:17 UTC
CVE-2026-103965An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting From the advisory An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. MongoDB Server NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	Medium	6.9	CVE-2026-87110	An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting MongoDB, Inc.MongoDB, Inc. Ops Manager	NVD	Oct 9 06:17 UTC
CVE-2026-87110An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting From the advisory An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. Ops Manager NIST National Vulnerability DatabasePublished Oct 9, 2026 06:17 UTC Read the advisory
	Medium	6.0	CVE-2026-87109	An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's... MongoDB, Inc.MongoDB, Inc. Ops Manager	NVD	Oct 9 06:17 UTC
CVE-2026-87109An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's... From the advisory An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. Ops Manager NIST National Vulnerability DatabasePublished Oct 9, 2026 06:17 UTC Read the advisory
	Low	2.3	CVE-2026-87108	An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required... MongoDB, Inc.MongoDB, Inc. Ops Manager	NVD	Oct 9 06:17 UTC
CVE-2026-87108An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required... From the advisory An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. Ops Manager NIST National Vulnerability DatabasePublished Oct 9, 2026 06:17 UTC Read the advisory
	Medium	5.9	CVE-2026-106435	The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a... MongoDB, Inc.MongoDB, Inc. Python Driver	NVD	Oct 8 21:17 UTC
CVE-2026-106435The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a... From the advisory The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.MongoDB, Inc. Python Driver NIST National Vulnerability DatabasePublished Oct 8, 2026 21:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory