https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:40:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-81521 <p>The MongoDB Go Driver&#39;s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.</p> <p>The MongoDB Go Driver&#39;s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-81521 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11803-1 <p>alloy-1.19.2-1.1 on GA media</p> <p>alloy-1.19.2-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11803-1 https://vulnerability.circl.lu/vuln/rhsa-2026:68006 <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling oras-go: oras-go: File store write outside working directory via symlink traversal net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents brace-expansion: DoS via unbounded inter…</p> <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling oras-go: oras-go: File store write outside working directory via symlink traversal net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents brace-expansion: DoS via unbounded inter…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:68006 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-81521 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-mongodb-mongo-driver, Ubuntu:26.04:LTS: golang-mongodb-mongo-driver</p> <p>The MongoDB Go Driver&#39;s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-mongodb-mongo-driver, Ubuntu:26.04:LTS: golang-mongodb-mongo-driver</p> <p>The MongoDB Go Driver&#39;s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-81521