CVE-2026-18708

MediumCVSS 6.4/10Last modified Sep 16, 2026

Description

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-187096.4An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progr CVE-2026-18716.5TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization CVE-2026-187106.5A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, t CVE-2026-187117.1An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal re CVE-2026-187128.1An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted CVE-2026-187138.8IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a r CVE-2026-187156.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML e CVE-2026-187169.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial CVE-2026-187177.4ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the CVE-2026-187187.0Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binar CVE-2026-187196.3A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Perform CVE-2026-187205.3A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/ac