The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
CVE-2026-106432 is a low-severity vulnerability in the MongoDB PHP Driver where the BSON encoder incorrectly converts string lengths to a 32-bit value without proper validation. This flaw can lead to a heap buffer overflow when encoding very large strings near 4 GiB in size, potentially causing process memory corruption or termination of the PHP process. Exploitation requires a non-default runtime configuration that permits multi-gigabyte string values and does not require interaction with the MongoDB server.
FreeScout versions prior to 1.8.235 contain a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts the CF-Connecting-IP header during failed login attempts without validation and stores this value in the activity log. The LogsMonitor component inserts this unescaped value into administrator alert emails, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.
CVE-2026-106438 is a medium severity vulnerability in the MongoDB C Driver involving incorrect calculation during Decimal128 string parsing. The driver improperly accepts certain over-precision decimal strings with leading zeros instead of rejecting them, causing the stored or used numeric value to differ from the original input. This can occur when an actor supplies a decimal string, including via Extended JSON parsing.
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
CVE-2026-106434 is a medium severity vulnerability in MongoDB libmongocrypt versions 1.5.0 up to but not including 1.20.5. The flaw involves improper validation of the integrity check value during explicit decryption, allowing unrecognized encrypted payloads to be returned unchanged instead of triggering a decryption error. This could lead to applications treating manipulated ciphertext as decrypted plaintext.
A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows an attacker to cause excessive memory allocation by providing a crafted MP4 file with an oversized 64-bit extended atom size. This can lead to denial of service due to process failure or resource exhaustion during parsing of certain MP4 atoms. The issue is fixed in version 11.16.0.
A vulnerability in Borewit's music-metadata prior to version 11.16.0 allows an attacker to cause excessive memory allocation by manipulating the length of VINT elements in Matroska and WebM EBML parsers. This can lead to out-of-memory denial of service or a fatal abort in Node.js 26.7.0. The issue is fixed in version 11.16.0.
A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows excessive memory allocation due to trusting the syncsafe tag-size field in ID3v2 tags. This can cause the parser to allocate up to approximately 268 MiB of memory for a truncated file, leading to a denial of service condition. The issue is fixed in version 11.16.0.
music-metadata version 11.15.0 contains a vulnerability in its APEv2 tag parser where it allocates memory based on an untrusted size value without verifying that the declared size fits within the actual file data. This can lead to excessive memory allocation and potential denial of service. The issue is limited to availability impact and does not affect confidentiality or integrity. The vulnerability is fixed in versions after 11.15.0.
CVE-2026-107324 is an integer overflow vulnerability in the BSON value-length handling of the MongoDB Go Driver. This flaw can cause a runtime panic when processing malformed BSON documents, potentially leading to denial of service. An unauthenticated attacker able to supply crafted BSON bytes may cause the application to terminate. The vulnerability affects specific versions of the MongoDB Go Driver. Panic recovery in the server-monitoring path limits impact to server-selection failures in that context.
CVE-2026-107322 is a high-severity vulnerability in the Amazon Agent Plugins for the AWS databases-on-aws plugin before version 1.7.1. It involves an incomplete list of disallowed inputs that may allow a remote unauthenticated attacker to execute arbitrary operating system commands on the host running the helper by crafting a malicious database command value. The issue is fixed in version 1.7.1 and later.
Coraza v3 prior to 3.8.1 improperly handles multipart file upload filenames when the RFC 5987 extended filename* parameter uses a charset other than us-ascii or utf-8, such as iso-8859-1. This causes Coraza to ignore the filename* value and instead use the plain filename parameter or no filename, allowing attackers to bypass file extension or name-based detection rules. The vulnerability affects the FILES and FILES_SIZES variables and the file-vs-field routing, potentially letting malicious uploads evade inspection. The issue is fixed in version 3.8.1 by independently decoding filename* without charset restrictions and exposing both filename and filename* values.
CVE-2026-107361 is an authentication bypass vulnerability in the Arkime live capture service (arkime-live) component of CISA Malcolm. The service runs in host network mode exposing port 8005 on all interfaces and trusts the X-Forwarded-User header from any IP address, automatically creating users with full access. The passwordSecret is hardcoded to a public value "Malcolm", allowing a network-adjacent attacker to bypass nginx and authenticate by connecting directly to port 8005 with a forged identity header. This vulnerability affects Malcolm versions up to and including 26.07.1.
CVE-2026-107302 is an out-of-bounds read vulnerability in the msgpack5 library for Node.js and browsers. Versions prior to 6.1.0 improperly read the length of a map32 value before fully validating the header, causing a RangeError instead of the expected IncompleteBufferError on truncated input. This can unexpectedly terminate requests, streams, or workers that rely on the IncompleteBufferError to wait for more data. The issue does not lead to memory disclosure and is fixed in version 6.1.0.
### Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
### Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
### Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
A vulnerability in msgpack5 prior to version 6.1.0 allows a remote attacker to cause a denial of service by exhausting memory. The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid, causing it to buffer data indefinitely while waiting for bytes that will never form a valid value. This issue is fixed in version 6.1.0.
### Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
### Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
### Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
Obsidian Desktop versions before 1.14.0 contain a cross-site scripting vulnerability in the bundled MathJax 3.2.2 Safe component. This flaw allows attackers to bypass URL filtering by embedding a crafted \href value with a TAB byte, resulting in an empty protocol that circumvents safeProtocols restrictions. An attacker can craft a note with a malicious MathJax formula that renders as a javascript: URL anchor. When clicked in Live Preview, this executes arbitrary operating system commands with the privileges of the desktop user via Node integration.
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.