fusionauth-samlv2

fusionauth-samlv2 This repository is SAML v2.0 bindings in Java using JAXB. You'd use this library to process SAML requests and responses. See the tests for example code. Security disclosures If you find a vulnerability or other security related bug, please report the vulnerability here before...

The vulnerability of MongoDB Compass’s graphical interface, a database management system by MongoDB, allows attackers to gain unauthorized access to protected information.

The vulnerability of MongoDB Compass’s graphical interface, a database management system for MongoDB, is related to improper code generation practices. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

EUVD-2025-27680

A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access...

MongoDB Compass 1.44.0 < 1.49.12 Code Injection

The version of MongoDB Compass installed on the remote host is 1.44.0 prior to 1.49.12. It is, therefore, affected by a vulnerability: - MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that...

MongoDB Compass < 1.39.4 Out-of-bounds Memory Access

The version of MongoDB Compass installed on the remote host is prior to 1.39.4. It is, therefore, affected by a vulnerability in the bundled Electron runtime, which was updated to version 24.8.2 in this release: - Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed ...

MongoDB Compass < 1.39.1 Multiple Vulnerabilities

The version of MongoDB Compass installed on the remote host is prior to 1.39.1. It is, therefore, affected by multiple vulnerabilities in the bundled Electron runtime, which was updated to version 23.3.12 in this release: - Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed ...

CVE-2026-96750

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

EUVD-2026-86260

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750

MongoDB Compass is vulnerable to a shell script injection because it fails to escape database names when interpolating them into the initial input of its embedded MongoDB shell . If a user opens the shell from a specific database's view, an attacker with privileges to create databases on the conn...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

PT-2026-98040

Name of the Vulnerable Software and Affected Versions MongoDB Compass affected versions not specified Description MongoDB Compass fails to escape the database name when interpolating it into the initial input of the embedded MongoDB shell. This occurs when a user opens the shell from a specific...

CVE-2026-96750: Improper Control of Generation of Code

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-13676)

Summary There are vulnerabilities in fast-uri-3.1.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-13676. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicod...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-49356)

Summary There are vulnerabilities in core-7.26.10.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-49356. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-49356 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Validation of Specified Quantity in Input (CVE-2026-33349)

Summary There are vulnerabilities in fast-xml-parser-4.4.1.tgz, fast-xml-parser-5.2.5.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33349. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33349 DESCRIPTION: fast-xml-parser allows users to process X...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-39406)

Summary There are vulnerabilities in node-server-1.19.11.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39406. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39406 DESCRIPTION: @hono/node-server allows running the Hono application on Node.js. Prio...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-39983)

Summary There are vulnerabilities in basic-ftp-5.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39983. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39983 DESCRIPTION: basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows F...