CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

EUVD-2026-47781

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881

CVE-2026-14881 affects MongoDB Compass: during imports of connections, an attacker can override connection options that are not normally changeable via the connection form. Specifically, a custom browser open command for the OIDC authentication flow can be injected, which is typically configured ...

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

PT-2026-63483

Name of the Vulnerable Software and Affected Versions Compass affected versions not specified Description When importing connections, it is possible to override connection options that are typically restricted to the connection form. Specifically, a custom browser open command can be provided for...

MongoDB Compass < 1.49.6 Prototype Pollution

The version of MongoDB Compass installed on the remote host is prior to 1.49.6. It is, therefore, affected by a vulnerability: - Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leadi...

MongoDB Compass 安全漏洞

MongoDB Compass is a free interactive tool provided by the American company MongoDB. It is used for querying, optimizing, and analyzing MongoDB data. There is a security vulnerability in MongoDB Compass, which stems from prototype pollution. This vulnerability may allow certain users to access...

Security Bulletin: MongoDB Enterprised Advanced affected by: Use After Free (CVE-2026-34764)

Summary There are vulnerabilities in electron-37.8.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-34764. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-34764 DESCRIPTION: Electron is a framework for writing cross-platform desktop applications...

Project Compass Targets 764 Network as 30 Arrested and Victims Rescued

Europol’s Project Compass targets The Com aka 764 network, an online group exploiting minors. After 30 arrests, officials say the hunt for those involved is far from over...

Malicious Package

Overview compass-e2e-tests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: Vulnerabilities in body-parser-2.2.0.tgz affecting MongoDB Enterprised Advanced (CVE-2025-13466)

Summary There is a vulnerability in body-parser-2.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-13466. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-13466 DESCRIPTION: body-parser 2.2.0 is vulnerable to denial of service due to inefficient...

Security Bulletin: Vulnerabilities in ai-5.0.26.tgz affecting MongoDB Enterprised Advanced (CVE-2025-48985)

Summary There is a vulnerability in ai-5.0.26.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-48985. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-48985 DESCRIPTION: A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta....

MAL-2026-922 Malicious code in compass-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27a245065291bd7252411254769a1764aab8e228c8ca161708734a3d47d3c9ec The package compass-e2e-tests was found to contain malicious code. Source: ghsa-malware...

Malicious code in compass-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27a245065291bd7252411254769a1764aab8e228c8ca161708734a3d47d3c9ec The package compass-e2e-tests was found to contain malicious code. Source: ghsa-malware...

CVE-2018-14989

The Plum Compass Android device with a build fingerprint of PLUM/c179hwf221/c179hwf221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed platform app with a package name of com.android.settings versionCode=23, versionName=6.0-eng.root.20161223.224055 that contains an exported...

CVE-2020-7635

compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...

Microsoft named an overall leader in KuppingerCole Leadership Compass for Generative AI Defense

Today, we are proud to share that Microsoft has been recognized as an overall leader in the KuppingerCole Leadership Compass for Generative AI Defense GAD, an independent report from a leading European analyst firm. This recognition reinforces the work we’ve been doing to deliver enterprise-ready...

Microsoft named an overall leader in KuppingerCole Leadership Compass for Generative AI Defense

Today, we are proud to share that Microsoft has been recognized as an overall leader in the KuppingerCole Leadership Compass for Generative AI Defense GAD, an independent report from a leading European analyst firm. This recognition reinforces the work we’ve been doing to deliver enterprise-ready...