CVE-2026-18706
Medium · 6.6CVSS
6.6
EPSS
0.5%
Published
Aug 11, 2026
CISA due date
—
The record
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-104608 A remote code execution vulnerability was identified in GitHub Enterprise Server in the… CWE-416
- CVE-2026-121257 Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-416
- CVE-2026-121246 Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a… CWE-416
- CVE-2026-121250 Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-416
- CVE-2026-121241 Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38… CWE-416
- CVE-2026-121238 Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-416
- CVE-2026-121217 Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent… CWE-416
- CVE-2026-121211 Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-416