EUVD-2026-54214

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

MAL-2026-12377 Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

Malicious code in server-hemera-mongo (npm)

npm/server-hemera-mongo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11986 Malicious code in server-hemera-mongo (npm)

npm/server-hemera-mongo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

MAL-2026-12017 Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303

Summary IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The...

ROS-20260728-73-0007

The vulnerability in the mongo-c-driver is related to copying buffers without checking the size of the input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

CVE-2026-16551 Denial-of-Service in OpenCanary's MongoDB module

Denial-of-Service in Thinkst Applied Research OpenCanary MongoDB module allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only...

ROOT-APP-GOBINARY-CVE-2026-2303 CVE-2026-2303 in rootio-go.mongodb.org/mongo-driver - Patched by Root

Root has patched CVE-2026-2303 in the rootio-go.mongodb.org/mongo-driver package for Root:Go. Multiple fixed versions available...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Mongo-object versions before 3.0.3 are vulnerable to prototype pollution via the expandKey() function in util.js, allowing an attacker to modify Object.prototype by crafting paths containing proto . This can lead to DoS or potentially remote code execution, depending on how polluted prototypes im...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

EUVD-2026-46151

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...