CVE-2026-18484
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper s
CVSS
6.5
Medium
EPSS
0.5%
p43
KEV
—
Exploit Today
13
0-100
Published: Nov 8, 2026 · Last modified: Nov 10, 2026 · CWE-706
0.5%EPSS · 30 days0.5%
2026-11-092026-11-11
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126902——
———Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)4hCVE-2026-126128—10.1%
——3The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.1dCVE-2026-1182078.8 HIG67.3%
——20Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.1dCVE-2026-1212009.6 CRI31.1%
——9Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)7dCVE-2026-1211338.1 HIG24.6%
——7Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)7dCVE-2026-1196758.6 HIG6.9%
——2MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.8d