CVE-2026-16551

MediumCVSS 6.9/10Last modified Oct 24, 2026

Description

Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation.

This issue affects OpenCanary 0.9.8 only.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-20CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-165535.4GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that CVE-2026-165547.8cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters CVE-2026-165574.3The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through aCVE-2026-165585.4The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoinCVE-2026-165596.8The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits theirCVE-2026-16565.3The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up toCVE-2026-165605.3A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close thCVE-2026-165617.5The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenCVE-2026-165626.5The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relyiCVE-2026-165636.5The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson CVE-2026-165644.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST CVE-2026-165654.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its p
CVE-2026-16551: Medium severity, CVSS 6.9 | Vulnix