Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,968

Export CSV
CVE-2026-120824

Post-authentication use-after-free in MongoDB Server time-series bucket validation

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120819

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-119893

Windows Audio Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 7 more
CVE-2026-13595

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Kernel Linux Redhat
Products
Util-linux Util-linux Cost Management On Premise and 8 more
CVE-2026-119865

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more