Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-13065

Publication date:

22/07/2026

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13061

Publication date:

22/07/2026

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2026

CVE-2026-13062

Publication date:

22/07/2026

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13066

Publication date:

22/07/2026

Improper handling of DBPointer objects during BSON serialization in MongoDB&#39;s server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13063

Publication date:

22/07/2026

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB&#39;s libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2026

CVE-2026-13064

Publication date:

22/07/2026

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13067

Publication date:

22/07/2026

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Severity CVSS v4.0: HIGH

Last modification:

24/07/2026

CVE-2026-13055

Publication date:

22/07/2026

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13056

Publication date:

22/07/2026

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13057

Publication date:

22/07/2026

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls.<br /> <br /> <br /> <br /> In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2026

CVE-2026-13058

Publication date:

22/07/2026

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-13060

Publication date:

22/07/2026

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

Subscribe to Vulnerabilities