PULSEUnderground Intel

EN VIVO33señales / 24h

FEED

ransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Servicesransomthegentlemen reclama a Esri South Africa · ZA · Technologyransomthegentlemen reclama a MEGATRANS · AR · Transportationransomthegentlemen reclama a United Pharmacy · SA · Healthcareransomthegentlemen reclama a Clancy Systems International · US · Government & Defenseransomthegentlemen reclama a Orennia · SE · Energy & Utilitiesransomthegentlemen reclama a City of Humboldt · CA · Government & Defenseransomthegentlemen reclama a Reso Tech Laurentides · CA · Technologyransomthegentlemen reclama a Darr Equipment · US · Manufacturingransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Servicesransomthegentlemen reclama a Esri South Africa · ZA · Technologyransomthegentlemen reclama a MEGATRANS · AR · Transportationransomthegentlemen reclama a United Pharmacy · SA · Healthcareransomthegentlemen reclama a Clancy Systems International · US · Government & Defenseransomthegentlemen reclama a Orennia · SE · Energy & Utilitiesransomthegentlemen reclama a City of Humboldt · CA · Government & Defenseransomthegentlemen reclama a Reso Tech Laurentides · CA · Technologyransomthegentlemen reclama a Darr Equipment · US · Manufacturing

← Todos los CVEs

CVE Watch12 nov 2026

CVE-2026-126835

The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced

CVSS

6.5

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-923

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.

Referencias oficiales

github.comhttps://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1199146.7 MED

——7Improper restriction of communication channel to intended endpoints in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.2d CVE-2026-1253616.3 MED

——1Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.3d CVE-2026-10756—

——2TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.8d CVE-2026-1109095.0 MED

——1Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.24d CVE-2026-1020856.5 MED

——6An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets. This issue affects Junos OS Evolved: * All versions before 23.2R2-S7.7-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S5.6-EVO; * 24.4 versions before 24.4R2-S4-EVO; * 25.2 version before 25.2R2-S1-EVO; * 25.4 versions before 25.4R1-S1-EVO. Please note that this issue is similar to but not identical CVE-2026-33803.28d CVE-2026-859258.2 ALT

——13Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.27d