{"vulnerability": "cve-2026-9674", "sightings": [{"uuid": "1eff9b4d-af25-49f2-974d-5e7b3432e674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96749", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwczdjty352c", "content": "\ud83d\udfe0 CVE-2026-96749 - High (8.4)\n\nAn integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundle...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-96749/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T05:16:54.641021Z"}, {"uuid": "5eaed741-1b77-4ffe-bd5a-b9a115b2e92a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-96744", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6", "content": "", "creation_timestamp": "2026-09-25T02:09:18.000000Z"}, {"uuid": "e2d7e386-08b0-40ce-ba56-6e35a6eeb425", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-96746", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6", "content": "", "creation_timestamp": "2026-09-25T02:09:18.000000Z"}, {"uuid": "0e3c8845-b460-4edd-ae4a-cd45fba9884d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-96748", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6", "content": "", "creation_timestamp": "2026-09-25T02:09:18.000000Z"}, {"uuid": "725f50fa-1cc3-454e-8f3d-941626dc48ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-96749", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6", "content": "", "creation_timestamp": "2026-09-25T02:09:18.000000Z"}, {"uuid": "7ec93145-376e-4bc9-80ed-ef8e5f189edf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96745", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "creation_timestamp": "2026-09-28T08:45:12.274868Z"}, {"uuid": "d07f5549-aba0-42de-9c12-7dfbc6443fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96746", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "creation_timestamp": "2026-09-28T08:45:12.304097Z"}, {"uuid": "d601ef91-8c1c-4a43-aa59-f8eefc7f05eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96747", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "creation_timestamp": "2026-09-28T08:45:12.324416Z"}, {"uuid": "5334a3ee-5023-4d5a-8516-66718151e933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96748", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "creation_timestamp": "2026-09-28T08:45:12.346660Z"}, {"uuid": "130825c4-3726-4c40-a55d-ab09f1893b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96749", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "creation_timestamp": "2026-09-28T08:45:12.366575Z"}, {"uuid": "6f5e570c-8885-4e4f-83eb-05db30bd0266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96740", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hboj5u5jz4x42", "content": "CVE-2026-96740 - Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties \u2192 sa-token exfiltration via config.providers\nCVE ID : CVE-2026-96740\n \n Published : Sept. 28, 2026, 6:17 p.m. | 16\u00a0minutes ago\n \n Description : A flaw wa...", "creation_timestamp": "2026-09-28T19:21:14.545842Z"}, {"uuid": "2386dc6d-bde0-47b7-9305-39ca66a7eba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-96749", "type": "seen", "source": "https://gist.github.com/alon710/bc410e99534ffbee2708ecb962d9c3f6", "content": "# CVE-2026-96749: CVE-2026-96749: Heap Out-of-Bounds Write in MongoDB PyMongo BSON Encoder\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96749\n\n## Summary\nAn integer overflow vulnerability exists in PyMongo's bundled C extension (bson/buffer.c) when serializing abnormally large documents. Due to compiler optimizations utilizing standard C Undefined Behavior rules, memory overflow validation checks are completely removed during compilation, enabling an attacker to trigger a heap-based out-of-bounds write.\n\n## TL;DR\nCompiler optimization of undefined signed integer overflow checks in PyMongo's native BSON encoder leads to heap-based buffer overflow when serializing objects larger than 2GiB.\n\n## Technical Details\n\n- **CWE ID**: CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow)\n- **Attack Vector**: Local (Elevated to Remote if exposing serialization endpoints)\n- **CVSS v3.1 Score**: 8.4 (High Severity)\n- **CVSS Vector**: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n- **EPSS Score**: 0.00132 (0.13% probability of exploitation)\n- **Exploit Status**: None (No public exploits or wild-exploitation documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running on 64-bit architectures using PyMongo with native C extensions enabled.\n- **PyMongo**: >= 1.9.0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade PyMongo to version 4.18.2 or higher.\n- Disable PyMongo native C extensions by setting the environment variable PYTHON_BSON_EXTENSIONS=0.\n- Implement application-level input size limits to reject payloads approaching MongoDB's 16MB maximum document size.\n\n**Remediation Steps:**\n1. Verify the installed PyMongo package version using 'pip show pymongo'.\n2. Execute 'pip install --upgrade pymongo>=4.18.2' to apply the official security patch.\n3. If upgrading is not possible, append 'export PYTHON_BSON_EXTENSIONS=0' to the environment profiles of your runtime systems.\n4. Introduce validation logic at input gateways to intercept and drop JSON/BSON structures that exceed defined size thresholds.\n\n## References\n\n- [GitHub Security Advisory GHSA-v4x9-3549-crwv](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv)\n- [NVD CVE-2026-96749 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-96749)\n- [PyMongo Bug Merge Commit](https://github.com/mongodb/mongo-python-driver/commit/6ab44be0e97c9d1d5a23725c4978fb25f3249485)\n- [PyMongo Fix Commit](https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7)\n- [PyMongo Pull Request 3066](https://github.com/mongodb/mongo-python-driver/pull/3066)\n- [PyMongo Release 4.18.2](https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2)\n- [PyMongo 4.18.2 Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst)\n- [CVE-2026-96749 Record](https://www.cve.org/CVERecord?id=CVE-2026-96749)\n- [Wiz Vulnerability Analysis Data](https://www.wiz.io/vulnerability-database/cve/cve-2026-96749)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96749) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T08:30:31.000000Z"}, {"uuid": "2606904e-eca0-4126-9ed0-0b7f85438e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96748", "type": "seen", "source": "https://gist.github.com/alon710/cf65fdaeab3dabc070aad5d3262b79fd", "content": "# CVE-2026-96748: CVE-2026-96748: Host Injection Vulnerability in PyMongo Connection String Parsing\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96748\n\n## Summary\nA critical host injection vulnerability exists in PyMongo's connection string parser prior to version 4.18.2. The parser globally decodes percent-encoded characters in the host portion before splitting on delimiters, allowing attackers to inject arbitrary servers into the database client's connection pool.\n\n## TL;DR\nPyMongo's parser decoded percent-encoded characters before splitting hostnames, allowing attackers to inject rogue servers into connection strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-177\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.3\n- **EPSS Score**: 0.00257 (15.78th percentile)\n- **Impact**: Host Injection / Adversary-in-the-Middle\n- **Exploit Status**: None (No public PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyMongo (Python Driver for MongoDB)\n- **PyMongo**: >= 0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade PyMongo to version 4.18.2 or later.\n- Implement rigorous regular expression validation on host input to reject any characters other than alphanumeric characters, hyphens, and periods.\n- Configure strict network egress rules to prevent connections to unknown or unauthorized external databases.\n\n**Remediation Steps:**\n1. Locate all installations of PyMongo in application dependencies (e.g., requirements.txt, Pipfile, poetry.lock).\n2. Update PyMongo version specification to >=4.18.2.\n3. Run pip install -r requirements.txt --upgrade or equivalent package manager commands to apply the update.\n4. Incorporate input sanitization routines for dynamic database connection host parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp6j-j7w5-5xjj](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj)\n- [Fix Commit: Refactoring of host split and decode order](https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a)\n- [CVE Record for CVE-2026-96748](https://www.cve.org/CVERecord?id=CVE-2026-96748)\n- [Official PyMongo Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96748) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T09:30:32.000000Z"}, {"uuid": "3f76cbfd-a738-47a5-8d7c-ba6ec5b0aefb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96747", "type": "seen", "source": "https://gist.github.com/alon710/6b2e563d3dfb8a7e8a2e8f33f484bf9e", "content": "# CVE-2026-96747: CVE-2026-96747: Local Unix Domain Socket SSRF via KMS Endpoint Manipulation in PyMongo\n\n> **CVSS Score:** 5.0\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96747\n\n## Summary\nA vulnerability in the Client-Side Field-Level Encryption (CSFLE) component of the MongoDB Python Driver (PyMongo) allows an attacker with database write access to trigger local Unix domain socket connections. By manipulating the Key Management Service (KMS) endpoint configuration inside the key vault collection to end with a '.sock' extension, an attacker forces the application to perform a Server-Side Request Forgery (SSRF) against internal Unix domain sockets.\n\n## TL;DR\nPyMongo's CSFLE key management parsing evaluates '.sock' suffixes as local Unix domain sockets rather than remote hostnames. Attackers with database write access can exploit this to achieve local SSRF against Unix domain sockets on the application host.\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.0 (Medium)\n- **Exploit Maturity**: none (no public PoC available)\n- **CISA KEV Status**: Not Listed\n- **Privileges Required**: Low (requires write access to key vault)\n- **Impact Category**: Low Confidentiality / Information Disclosure via SSRF\n\n## Affected Systems\n\n- Applications utilizing MongoDB Python Driver (PyMongo) client-side field-level encryption (CSFLE)\n- Applications running PyMongo in environments with exposed or sensitive local Unix domain sockets\n- **PyMongo (MongoDB Python Driver)**: >= 3.9.0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade the MongoDB Python Driver (PyMongo) to version 4.18.2 or newer to enforce strict validation on KMS endpoints.\n- Restrict database-level privileges to prevent unauthorized users from performing write operations on CSFLE key vault collections.\n- Avoid mounting local Unix domain sockets (e.g., docker.sock) into containerized application environments.\n- Enable database auditing to monitor write, update, and insert activities within encryption-related metadata collections.\n\n**Remediation Steps:**\n1. Identify all deployment environments running affected PyMongo versions (>=3.9.0, <4.18.2).\n2. Upgrade the PyMongo library using the package manager: pip install --upgrade pymongo>=4.18.2.\n3. Implement role-based access control (RBAC) in MongoDB to restrict 'insert' and 'update' permissions on the 'admin.datakeys' collection.\n4. Deploy system-level controls (e.g., AppArmor, SELinux) to block Python runtimes from interacting with unauthorized local IPC paths.\n\n## References\n\n- [GitHub Security Advisory GHSA-qx36-8mw2-4r3x](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x)\n- [NVD CVE-2026-96747 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-96747)\n- [CVE.org CVE-2026-96747 Record](https://www.cve.org/CVERecord?id=CVE-2026-96747)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96747) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T10:30:34.000000Z"}]}