Premiere Pro contains an Untrusted Search Path vulnerability (CVE-2026-48402) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability is rated high severity with a CVSS score of 7.8.
Adobe After Effects contains a heap-based buffer overflow vulnerability that may allow an attacker to execute arbitrary code with the privileges of the current user. Successful exploitation requires user interaction, specifically opening a crafted malicious file. This vulnerability has a high severity rating with a CVSS score of 7.8.
A vulnerability exists in a replica-set database server node where it fails to limit or reclaim internal wait records created when processing a client-supplied read option specifying a point in time the node will never reach. An unauthenticated attacker with network access can cause these records to accumulate indefinitely, potentially exhausting server memory and causing a denial of service.
CVE-2026-120826 is an authorization flaw affecting sharded database deployments. It allows a user with basic read-write privileges on a single database to create a view whose processing bypasses full privilege checks. Consequently, reading this view may expose data from other databases on the same shard, leading to unintended data access.
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript support for aggregation. An authenticated user with minimal or no roles can exploit this by submitting a crafted aggregation request, potentially causing the server to return stale memory contents. This may expose adjacent process memory data and could impact server availability.
A vulnerability in MongoDB Server allows omission of an authorization check on resources targeted by replication-related administrative commands. Users with backup and restore privileges may access and move collections beyond their permitted scope, potentially leading to unauthorized data access and unintended modifications to the collection catalog.
An authorization weakness in MongoDB Server's aggregation framework allows an authenticated user with basic database privileges to read data from collections they should not have access to. This occurs because privilege checks during view definition validation do not cover nested pipeline portions, leading to unintended data exposure including sensitive authentication material.
CVE-2026-120820 is a vulnerability in MongoDB Server where an in-memory table tracking per-namespace statistics for encrypted-field operations grows without limit. Any user with basic read privileges can cause the server to consume increasing memory by issuing read commands referencing arbitrary namespaces. This memory is only freed upon server restart, potentially leading to degraded performance due to memory exhaustion.
A memory-management flaw in MongoDB Server's server-side JavaScript execution component allows an authenticated user with read-only privileges to access memory that has already been freed. By submitting a specially crafted command running user-supplied JavaScript, the user can retrieve a limited amount of adjacent process memory, potentially exposing unauthorized information. This vulnerability does not impact data integrity or server availability.
A use-after-free vulnerability exists in the aggregation framework of MongoDB Server when certain expressions are evaluated in an aggregation sub-pipeline. This flaw can be triggered by an authenticated user with read privileges and may cause the server to terminate unexpectedly, leading to denial of service.
A use-after-free vulnerability exists in the time-series collection component of MongoDB Server during validation of time-series bucket documents on write operations. This flaw can be triggered by an authenticated user with privileges to write bucket documents directly. Exploitation may cause the server to crash or, under certain conditions, allow arbitrary code execution within the server process.
A vulnerability in MongoDB Server's aggregation framework allows users with any valid credentials, even those without assigned roles, to read deployment-wide query configuration data. This data is normally restricted to users with cluster-level privileges. The issue could lead to unintended exposure of configuration and schema information.
A race condition vulnerability exists in the schema validation component of MongoDB Server when concurrent writes are validated against a collection validator using geospatial query operators. This flaw can be triggered by an authenticated user with write privileges and may cause the server to terminate unexpectedly, leading to a denial of service condition.
Photoshop Desktop contains an out-of-bounds read vulnerability that may disclose sensitive memory contents. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.
A vulnerability exists where a user with basic read-tier database privileges can exploit a server-side data-change notification feature to access contents of certain restricted internal collections. This occurs because the privilege check only considers the target namespace and ignores the option that allows access to these internal collections. As a result, users can gain unintended read access to data they are normally denied when attempting direct reads.
CVE-2026-118383 is a critical use-after-free vulnerability in the replication component of MongoDB Server. It occurs when a newly elected replica set primary completes catch-up. The flaw can be triggered by unauthenticated requests and may cause the server to crash or, under certain conditions, allow arbitrary code execution. This affects replica set members, including shard and config server replica sets in sharded clusters, but not standalone mongod instances.
Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability does not impact confidentiality or integrity but affects availability.
Photoshop Desktop contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.
Photoshop Desktop has an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.
Photoshop Desktop contains a Use After Free vulnerability that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a high severity rating with a CVSS score of 7.8.