https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:18:39 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-18710 <p>A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application&#39;s logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.</p> <p>A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application&#39;s logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-18710 https://vulnerability.circl.lu/vuln/rhsa-2026:63302 <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> https://vulnerability.circl.lu/vuln/rhsa-2026:63302 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-18710 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mongo-java-driver, Ubuntu:18.04:LTS: mongo-java-driver, Ubuntu:20.04:LTS: mongo-java-driver, Ubuntu:22.04:LTS: mongo-java-driver, Ubuntu:24.04:LTS: mongo-java-driver, Ubuntu:26.04:LTS: mongo-java-driver</p> <p>A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application&#39;s logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mongo-java-driver, Ubuntu:18.04:LTS: mongo-java-driver, Ubuntu:20.04:LTS: mongo-java-driver, Ubuntu:22.04:LTS: mongo-java-driver, Ubuntu:24.04:LTS: mongo-java-driver, Ubuntu:26.04:LTS: mongo-java-driver</p> <p>A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application&#39;s logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-18710