Threat database

CVE-2026-107325 is a high-severity vulnerability in the MongoDB Go Driver involving improper validation of BSON array lengths. This flaw can cause an out-of-bounds index and runtime panic when bson.RawArray.Validate or bsoncore.Array.Validate is called on a malformed four-byte array. An unauthenticated attacker able to supply raw BSON array data to the affected application may cause the application process to terminate, resulting in a denial of service. There is no identified impact on confidentiality or integrity.

A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows excessive memory allocation due to trusting the syncsafe tag-size field in ID3v2 tags. This can cause the parser to allocate up to approximately 268 MiB of memory for a truncated file, leading to a denial of service condition. The issue is fixed in version 11.16.0.

IBM Guardium Data Protection version 12.2.2 contains a denial-of-service vulnerability in its edge-controller component. An unauthenticated remote attacker with network access to the edge-controller's gRPC service can send malformed task data that triggers an unchecked type assertion, causing the edge-controller process to crash unexpectedly. This results in service disruption without impacting confidentiality or integrity.

music-metadata version 11.15.0 contains a vulnerability in its APEv2 tag parser where it allocates memory based on an untrusted size value without verifying that the declared size fits within the actual file data. This can lead to excessive memory allocation and potential denial of service. The issue is limited to availability impact and does not affect confidentiality or integrity. The vulnerability is fixed in versions after 11.15.0.

IBM Guardium Data Protection 12.2 contains a command injection vulnerability in the SUID-root ssh_config_wrapper component. This flaw allows an authenticated high-privileged user to inject arbitrary commands, which are executed with root privileges. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity.

CVE-2026-107324 is an integer overflow vulnerability in the BSON value-length handling of the MongoDB Go Driver. This flaw can cause a runtime panic when processing malformed BSON documents, potentially leading to denial of service. An unauthenticated attacker able to supply crafted BSON bytes may cause the application to terminate. The vulnerability affects specific versions of the MongoDB Go Driver. Panic recovery in the server-monitoring path limits impact to server-selection failures in that context.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a vulnerability in the WfpMonitor kernel driver where certain IOCTL handlers improperly validate user-supplied pointers. This flaw can allow a privileged local attacker to cause a system crash or perform limited kernel-memory reads.

CVE-2026-106429 is an integer underflow vulnerability in MongoDB's libmongocrypt library affecting versions from 1.1.0 up to but not including 1.20.5. The flaw occurs in the KMS endpoint-parsing logic and can cause an allocation failure that terminates the application process. Exploitation requires an authenticated user to modify a key document in the key vault collection or for an application to accept a specially crafted KMS endpoint containing a colon after its path or query during key creation. This vulnerability does not lead to memory corruption or out-of-bounds access.

CVE-2026-105452 is a medium severity vulnerability in Docker Sandboxes where client-supplied credentials can be forwarded alongside host proxy credentials due to insufficient filtering of authentication headers. This allows untrusted code running in an authorized sandbox to supply unrecognized credentials, potentially leading to authentication as an attacker-controlled account and exposure of sensitive data in requests.

CVE-2026-40804 is a high-severity reflected cross-site scripting (XSS) vulnerability in Kodezen LLC aBlocks affecting versions 0 through 2.16.0. The flaw is due to improper neutralization of input during web page generation, enabling attackers to inject malicious scripts that execute in users' browsers. This can lead to partial impacts on confidentiality, integrity, and availability. No patch or remediation information is currently available.

CVE-2026-101998 is a medium severity vulnerability in Docker Sandboxes where the system may fail open when handling protected proxy responses. This occurs if a response-body read returns data along with an error, potentially causing sensitive bytes to be forwarded unmasked. This flaw could allow code running inside an authorized sandbox to access host-managed OAuth tokens or an Anthropic API key that should remain protected outside the sandbox.

CVE-2026-105570 is a medium severity vulnerability in Docker Sandboxes involving improper handling of case sensitivity. The issue arises because OAuth token-endpoint hostnames were compared case-sensitively, while DNS routing is case-insensitive. This discrepancy allowed untrusted sandbox code to bypass response masking by using case-variant hostnames, potentially exposing unmasked OAuth access and refresh tokens if the OAuth flow completed.

CVE-2026-106430 is a medium severity vulnerability in the MongoDB C++ Driver versions 3.0.0 up to but not including 4.6.1. The vulnerability arises because the driver discards content after an embedded NUL byte in certain field and collection names, leading to interpretation conflicts between the driver and the application. An authenticated user who can influence these names may cause the application to read or rename unintended fields or collections using the application's existing database credentials.

MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a SQL injection vulnerability due to improper escaping of special characters in text-protocol mode when the NO_BACKSLASH_ESCAPES SQL mode is enabled. This allows an attacker to inject arbitrary SQL commands by closing string literals improperly. The vulnerability does not affect execute() and batch() methods that use binary protocols. Fixed versions have been released to address this issue.

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains a critical OS command injection vulnerability in the ImageOptimizer#identify_format method. This flaw allows attackers to execute arbitrary OS commands by supplying a crafted image path when the identify option is enabled. The vulnerability arises because user-controlled input, such as an uploaded file name, is passed to Ruby backticks without proper sanitization, enabling shell metacharacters to be executed with the privileges of the Ruby process.

CVE-2026-107703 is a critical OS command injection vulnerability in the @enmaso/node-convert package up to version 1.0.0. The flaw occurs in convert.js where unsanitized user inputs for filepath and convertTo are passed directly to a child_process.exec() call that runs ImageMagick commands. This allows an attacker to inject shell metacharacters or single quotes to execute arbitrary OS commands with the privileges of the Node.js process.

dot-access versions up to 1.0.0 contain a prototype pollution vulnerability. This flaw allows attackers to modify Object.prototype by supplying crafted dotted paths to the set() function. Exploitation can lead to injection of properties into all objects, potentially altering authorization flags, option defaults, or causing process crashes. The vulnerability is rated high severity with a CVSS score of 8.8.

dot-access versions 0.0.3 through 1.0.0 contain a critical code injection vulnerability. Remote attackers can execute arbitrary JavaScript by supplying crafted paths to the get() function. This occurs because the path input is concatenated into a new Function body, enabling attackers to access constructor.constructor and execute operating system commands via Node.js child_process.

ppt2png versions up to 0.0.6 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary operating system commands by injecting shell metacharacters into file name arguments passed to the child_process.exec() function in Node.js. The vulnerability arises from improper sanitization of input or output path arguments.

MariaDB Connector/Node.js versions from 3.2.0 up to but not including 3.2.5, 3.3.0 up to 3.3.4, 3.4.0 up to 3.4.7, and 3.5.0-rc.0 up to 3.5.4 contain a SQL injection vulnerability when the permitSetMultiParamEntries option is enabled. This flaw allows attacker-controlled keys with backticks to inject arbitrary SQL commands, potentially modifying unintended database columns and executing commands with the database user's privileges. The option is disabled by default, and serialized-object handling when disabled is not affected. The issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.