CVE-2026-1847

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-184707.5The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and CVE-2026-184739.1The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, lea CVE-2026-184748.6The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a CVE-2026-184774.4A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write a CVE-2026-184785.1Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into t CVE-2026-18487.5Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number o CVE-2026-184808.8The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permissio CVE-2026-184817.3Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to ste CVE-2026-184829.8Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, w CVE-2026-184857.8There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated CVE-2026-184868.8IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and esc CVE-2026-184875.4A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address