https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:52:23.358035+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mongodb-2026-9743 BIT-mongodb-2026-9743 — Aggregation sub-pipeline null dereference may allow DoS via crafted getMore 2026-10-04T00:52:23.434640+00:00

Affected: Bitnami: mongodb

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0735 certfr-2026-avi-0735 — De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer un déni de s… 2026-10-04T00:52:23.434702+00:00 certfr-2026-avi-0735 https://cve.radiocsirt.org/vuln/euvd-2026-326374 EUVD-2026-326374 2026-10-04T00:52:23.434723+00:00 EUVD-2026-326374 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9743 fkie_cve-2026-9743 2026-10-04T00:52:23.434737+00:00

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

 https://cve.radiocsirt.org/vuln/ghsa-cmc7-vq67-x4pm GHSA-cmc7-vq67-x4pm 2026-10-04T00:52:23.434762+00:00

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0209 NCSC-2026-0209 — Kwetsbaarheden verholpen in MongoDB Server 2026-10-04T00:52:23.434780+00:00 NCSC-2026-0209 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9743 UBUNTU-CVE-2026-9743 2026-10-04T00:52:23.434816+00:00

Affected: Ubuntu:Pro:14.04:LTS: mongodb, Ubuntu:Pro:16.04:LTS: mongodb, Ubuntu:Pro:18.04:LTS: mongodb, Ubuntu:Pro:20.04:LTS: mongodb

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1868 WID-SEC-W-2026-1868 — MongoDB: Mehrere Schwachstellen 2026-10-04T00:52:23.434843+00:00

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.