Posts of last few hours

CVE-2026-81528 | MongoDB C# Driver up to 3.11.0 Document Replacement neutralization
A vulnerability, which was classified as critical, has been found in MongoDB C# Driver up to 3.11.0. Affected by this issue is some unknown functionality of the component Document Replacement. This manipulation causes improper neutralization. This vulnerability is tracked as CVE-2026-81528. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/396398
CVE-2026-81527 | MongoDB C# Driver up to 3.11.0 Query Translation injection
A vulnerability classified as critical was found in MongoDB C# Driver up to 3.11.0. Affected by this vulnerability is an unknown functionality of the component Query Translation. The manipulation results in injection. This vulnerability is identified as CVE-2026-81527. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.
https://vuldb.com/vuln/396397
CVE-2026-81526 | MongoDB Rust Driver up to 3.8.1 improper authorization
A vulnerability classified as problematic has been found in MongoDB Rust Driver up to 3.8.1. Affected is an unknown function. The manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-81526. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/396396
CVE-2026-81524 | MongoDB C Driver up to 2.5.0 os command injection
A vulnerability described as critical has been identified in MongoDB C Driver up to 2.5.0. This impacts an unknown function. Executing a manipulation can lead to os command injection. The identification of this vulnerability is CVE-2026-81524. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.
https://vuldb.com/vuln/396395
CVE-2026-81931 | Roskus Prospero Flow CRM up to 5.15.x Photo Upload product save unrestricted upload
A vulnerability marked as critical has been reported in Roskus Prospero Flow CRM up to 5.15.x. This affects the function ProductSaveController::save of the file public/asset/upload/product of the component Photo Upload. Performing a manipulation results in unrestricted upload. This vulnerability was named CVE-2026-81931. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/396394
CVE-2026-81729 | Dolibarr up to 23.0.3 Document Deletion API api_documents.class.php Documents::delete mode privileges management
A vulnerability labeled as problematic has been found in Dolibarr up to 23.0.3. The impacted element is the function Documents::delete of the file htdocs/api/class/api_documents.class.php of the component Document Deletion API. Such manipulation of the argument mode leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-81729. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.
https://vuldb.com/vuln/396393
CVE-2026-81728 | Dolibarr up to 23.x Import Wizard import.php import_insert updatekeys sql injection
A vulnerability identified as critical has been detected in Dolibarr up to 23.x. The affected element is the function import_insert of the file htdocs/imports/import.php of the component Import Wizard. This manipulation of the argument updatekeys causes sql injection. This vulnerability is handled as CVE-2026-81728. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.
https://vuldb.com/vuln/396392
CVE-2026-81525 | MongoDB PHP Library Namespace Identifier code injection
A vulnerability categorized as critical has been discovered in MongoDB PHP Library. Impacted is an unknown function of the component Namespace Identifier. The manipulation results in code injection. This vulnerability is known as CVE-2026-81525. It is possible to launch the attack remotely. No exploit is available.
https://vuldb.com/vuln/396391
CVE-2026-81730 | Dolibarr up to 23.0.4 emailcollector emailcollector.lib.php saveAttachment filename path traversal
A vulnerability was found in Dolibarr up to 23.0.4. It has been rated as critical. This issue affects the function saveAttachment of the file htdocs/emailcollector/lib/emailcollector.lib.php of the component emailcollector. The manipulation of the argument filename leads to path traversal. This vulnerability is traded as CVE-2026-81730. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.
https://vuldb.com/vuln/396390
CVE-2026-59306 | VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 deserialization
A vulnerability was found in VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2. It has been declared as problematic. This vulnerability affects unknown code. Executing a manipulation can lead to deserialization. This vulnerability appears as CVE-2026-59306. The attack may be performed from remote. There is no available exploit.
https://vuldb.com/vuln/396389
CVE-2026-59304 | VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 type confusion
A vulnerability was found in VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2. It has been classified as problematic. This affects an unknown part. Performing a manipulation results in type confusion. This vulnerability is reported as CVE-2026-59304. The attack is possible to be carried out remotely. No exploit exists.
https://vuldb.com/vuln/396388
CVE-2026-59303 | VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 allocation of resources
A vulnerability was found in VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 and classified as problematic. Affected by this issue is some unknown functionality. Such manipulation leads to allocation of resources. This vulnerability is documented as CVE-2026-59303. The attack can be executed remotely. There is not any exploit available.
https://vuldb.com/vuln/396387
CVE-2026-59302 | VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 Logging log file
A vulnerability has been found in VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Logging. This manipulation causes sensitive information in log files. This vulnerability is registered as CVE-2026-59302. Remote exploitation of the attack is possible. No exploit is available.
https://vuldb.com/vuln/396386
CVE-2026-59305 | VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2 Partition Interceptor incorrect behavior order
A vulnerability, which was classified as problematic, was found in VMware Spring Cloud Stream up to 4.2.6/4.3.3/5.0.2. Affected is an unknown function of the component Partition Interceptor. The manipulation results in incorrect behavior order. This vulnerability is cataloged as CVE-2026-59305. The attack may be launched remotely. There is no exploit available.
https://vuldb.com/vuln/396385
CVE-2026-66353 | woylie doggo up to 0.14.7 Date Field lib/doggo.ex Doggo.normalize_value cross site scripting
A vulnerability, which was classified as problematic, has been found in woylie doggo up to 0.14.7. This impacts the function Doggo.normalize_value of the file lib/doggo.ex of the component Date Field. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-66353. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/396384
CVE-2026-59311 | VMware Spring Integration up to 6.4.12/6.5.10/7.0.5/7.1.0 ZipTransformer link following
A vulnerability classified as problematic was found in VMware Spring Integration up to 6.4.12/6.5.10/7.0.5/7.1.0. This affects an unknown function of the component ZipTransformer. Executing a manipulation can lead to link following. This vulnerability is tracked as CVE-2026-59311. The attack is restricted to local execution. No exploit exists.
https://vuldb.com/vuln/396383
CVE-2026-74820 | ServiceNow AI Platform sql injection
A vulnerability classified as critical has been found in ServiceNow AI Platform. The impacted element is an unknown function. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-74820. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/396382
CVE-2026-6876 | ServiceNow Now Platform sandbox
A vulnerability described as critical has been identified in ServiceNow Now Platform. The affected element is an unknown function. Such manipulation leads to sandbox issue. This vulnerability is referenced as CVE-2026-6876. It is possible to launch the attack remotely. No exploit is available.
https://vuldb.com/vuln/396381
CVE-2026-59322 | VMware Spring Integration up to 7.1.0 Header Parsing input validation
A vulnerability marked as critical has been reported in VMware Spring Integration up to 5.5.21/6.4.12/6.5.10/7.0.5/7.1.0. Impacted is the function EmbeddedHeadersJsonMessageMapper.decodeNativeFormat of the component Header Parsing. This manipulation causes improper input validation. The identification of this vulnerability is CVE-2026-59322. It is possible to initiate the attack remotely. There is no exploit available.
https://vuldb.com/vuln/396380
CVE-2026-59321 | VMware Spring Integration up to 7.1.0 race condition
A vulnerability labeled as critical has been found in VMware Spring Integration up to 5.5.21/6.4.12/6.5.10/7.0.5/7.1.0. This issue affects some unknown processing. The manipulation results in race condition. This vulnerability was named CVE-2026-59321. The attack may be performed from remote. There is no available exploit.
https://vuldb.com/vuln/396379

Managed ad