CVE WatchNov 10, 2026

CVE-2026-120810

An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-770

EPSS · 30d

Not enough EPSS history yet.

Technical description

An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’s out-of-memory killer.

Official references

jira.mongodb.orghttps://jira.mongodb.org/browse/SERVER-132430

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1213708.6 HIG

—

——0On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.3h CVE-2026-1213695.3 MED

—

——0On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot.3h CVE-2026-1253277.5 HIG

—

——0pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0.4h CVE-2026-1187507.5 HIG

—

——0Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.3h CVE-2026-1187487.5 HIG

—

——0Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.3h CVE-2026-1141497.5 HIG

—

——0Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.3h