Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
A prototype pollution vulnerability exists in Automattic's mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. The issue arises when user-controlled updates with a __proto__.x dotted path under $set are passed to update functions, allowing modification of Object.prototype properties. This can affect application integrity and availability. The vulnerability has a CVSS score of 6.5 (medium severity). Join the discussion | CVE Database V5 | 08/13/2026, 17:27:09 UTC Added: 08/13/2026, 17:57:34 UTC |
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6. Join the discussion | CVE Database V5 | 05/14/2026, 18:03:43 UTC Added: 05/14/2026, 18:21:46 UTC |
0 Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. Join the discussion | CVE Database V5 | 09/25/2025, 08:46:40 UTC Added: 02/25/2026, 21:35:23 UTC |
0 Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Join the discussion | CVE Database V5 | 12/02/2024, 00:00:00 UTC Added: 02/25/2026, 21:38:10 UTC |
Showing 1 to 4 of 4 results