Muhammaddaffa

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x **Description** A flaw in the Node.js Permission API allows file metadata to be modified even when a path is configured as read-only, such as when using the `--allow-fs-read` flag. **Recommendations** Update Node.js 22.x to the latest patched version. Update Node.js 24.x to the latest patched version. Update Node.js 26.x to version 26.3.1-1.1 or later.

**Name of the Vulnerable Software and Affected Versions** MongoDB (affected versions not specified) **Description** A server crash occurs when using `$changestreams` and `$ requestReshardingResumeToken` with the exchange option. This issue is triggered when the server hits an invariant, and it can be executed by any logged-in user without requiring special privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An authorized user can cause a server crash by executing a query using a 2dsphere index on a field containing a GeoJSON GeometryCollection. The issue occurs when the collection includes a Polygon with a strict-winding Coordinate Reference System (CRS). While strict-winding polygons are unsupported for indexing, the system fails to inspect members within a GeometryCollection, leading to a null-pointer dereference, which is an attempt to access a memory location that does not exist. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.