VulnSocial

CVE-2026-59509Disclosure

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-06); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-05: 1Mentions · 2026-07-06: 2Mentions · 2026-09-15: 1Patch / Workaround · 2026-07-05: 1Technical Details · 2026-07-05: 1Technical Details · 2026-07-06: 2Technical Details · 2026-09-15: 107-0507-0609-15
Signal classification1 categories
Disclosure
4100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-051
Disclosure1
2026-07-062
Disclosure2
2026-09-151
Disclosure1
Full discourse4 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-59509 - critical 🚨 cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection > cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint t... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-59509 @pdnuclei #NucleiTemplates #cve

    Post summary

    The text announces CVE-2026-59509 as a critical unauthenticated NoSQL injection affecting cve-search 4.0 through 6.0.0. It provides basic technical details but no PoC, exploit code, active exploitation claim, or remediation guidance.

    01071393
    1.3K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-59509 An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters con… https://www.cve.org/CVERecord?id=CVE-2026-59509

    Post summary

    The statement announces CVE‑2026‑59509, detailing an unauthenticated input validation flaw in cve‑search’s /fetch_cve_data endpoint without providing PoC, exploit, or patch information.

    00010786
    57.7K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-59509 An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters con… https://www.cve.org/CVERecord?id=CVE-2026-59509 ----- Traducción: CVE-2026-59509 Una… http://infoflow.cloud`

    Post summary

    A new unauthenticated input validation flaw affecting the POST /fetch_cve_data endpoint of cve-search has been announced, with no exploit, patch, or evidence of active misuse provided.

    0000040
    92 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 CRITICAL - Unauth MongoDB Collection Read via /fetch_cve_data Parameter Tampering (CVE-2026-59509) An unauthenticated improper input validation flaw exists in cve-search’s POST /fetch_cve_data endpoint, allowing attacker-controlled parameters to influence MongoDB collection selection, projected fields, and regex filters. The root cause is improper input validation/authorization on query construction, effectively enabling MongoDB query/collection injection. An attacker can exploit this remotely with no credentials by crafting POST requests that pivot the backend query to arbitrary application collections (including sensitive ones like mgmt_users). Impact includes unauthorized disclosure of administrative usernames and password hashes, enabling offline cracking and potential admin account takeover leading to broader data access and control. 👉 Affected: cve-search (versions not specified) | Upgrade to vendor-fixed release (not yet specified) or restrict/disable /fetch_cve_data and enforce strict allowlists immediately

    Post summary

    Critical unauthenticated MongoDB collection read flaw in cve-search’s /fetch_cve_data endpoint could expose sensitive data; users should update or restrict the endpoint immediately.

    0000098
    237 followersView on X

Explore more

Back to dashboard