CVE-2026-115930

MediumCVSS 6.8/10Last modified Nov 2, 2026

Description

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1159319.9Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functi CVE-2026-1159329.6When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that th CVE-2026-1159339.9Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route CVE-2026-1159349.8An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query e CVE-2026-1159358.8The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admi CVE-2026-1159377.5The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * comm CVE-2026-1159388.8Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandbox CVE-2026-115946.1IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.CVE-2026-1159427.5A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the CVE-2026-1159439.8Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number CVE-2026-1159469.8XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compil CVE-2026-1159476.5Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.