libmongocrypt

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Application denial of service via malformed KMS endpoint in MongoDB libmongocryptCVE-2026-106429MongoDB · CVSS 6.5 · 0.3% likely

   CWE-191

2. KMS request injection via unsanitized key vault and provider values in libmongocryptCVE-2026-114655MongoDB · CVSS 5.9 · 0.3% likely

   CWE-74

3. Heap corruption via duplicate masterKey fields in MongoDB libmongocryptCVE-2026-106433MongoDB · CVSS 8.8 · 0.3% likely

   CWE-843

4. Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption pathCVE-2026-84971MongoDB · CVSS 6.5 · 0.3% likely

   CWE-617

5. Authenticated KMS request forgery via CRLF injection in GCP key identifier stringsCVE-2026-84962MongoDB · CVSS 4.2 · 0.2% likely

   CWE-93

6. Unrecognized payload acceptance in explicit decryption in MongoDB libmongocryptCVE-2026-106434MongoDB · CVSS 4.3 · 0.1% likely

   CWE-354

7. Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocryptCVE-2026-81523MongoDB · CVSS 4.4 · 0.1% likely

   CWE-74

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.