Critical Alert 1 Active Exploit Detected Today

CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability →
Powered by CVE Watchtower
×
October 2, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-13078NVD

Vulnerability Summary

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
Severity Level
HIGH(7.7)
Published Date
Jul 22, 2026
Last Modified
Jul 23, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.21%Probability
Root Weakness (CWE)
CWE-862: Missing Authorization ↗
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v4.0 Base Metrics — Score 6.3 (MEDIUM)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)None
Availability (Vulnerable System)None
Confidentiality (Subsequent System)High
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.7 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

Affected & Patched Versions

Affected Versions
  • MongoDB MongoDB Server >= 7.0 and < 7.0.39
  • MongoDB MongoDB Server >= 8.0 and < 8.0.28
  • MongoDB MongoDB Server >= 8.2.0 and < 8.2.12
  • MongoDB MongoDB Server >= 8.3.0 and < 8.3.7
Patched Versions
  • MongoDB MongoDB Server 7.0.39
  • MongoDB MongoDB Server 8.0.28
  • MongoDB MongoDB Server 8.2.12
  • MongoDB MongoDB Server 8.3.7
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References