EUVD-2026-60613

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-18710

A flaw was found in org.mongodb/mongodb-driver. During routine client initialization, sensitive configuration information, including credentials for outbound network connectivity, is written to application log output in cleartext. A local attacker with the ability to read the affected application...

BIT-MONGODB-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

BIT-MONGODB-2026-13068 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

BIT-MONGODB-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

GO-2026-5021 vulnerabilities

Vulnerabilities for packages: telegraf, keda-fips, gitlab-rails-ce-fips, traefik, harbor, gitsign, etcd-fips, commercial-grafana, kyverno-fips, argo-events-fips, argo-cd, kubernetes, vault, grafana-fips, etcd, omnictl-multiarch, argo-events, harbor-fips, loki, argo-workflows, containerd,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver, step-issuer, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl, opentelemetry-operator, percona-server-mongodb-operator, mariadb-operator...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, buildah, dask-gateway, haproxy-ingress, rook, cert-exporter, ksops, cis-operator, flux, mountpoint-s3-csi-driver, pulumi-language-java, tetragon, argocd-image-updater, cri-tools, crossplane-provider-aws-firehose, crossplane-provider-aws-sns,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: nri-f5, pulumi, rook, cert-manager-csi-driver, cilium-cli, kubernetes-dashboard-metrics-scraper, cis-operator, flux, argocd-image-updater, polaris, vertical-pod-autoscaler, filebrowser, cluster-api-ipam-provider-in-cluster, custom-pod-autoscaler-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kubernetes-dashboard-api, nri-f5, dask-gateway, tfsec, rancher-system-agent, verticadb-operator, cilium-cli, ksops, kubernetes-dashboard-metrics-scraper, nri-postgresql, yace, mountpoint-s3-csi-driver, tetragon, crossplane-provider-aws-firehose...

EUVD-2026-58506

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-18888

creationtimestamp| type| source ---|---|--- 2026-08-13 12:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-2...

CVE-2026-19004

creationtimestamp| type| source ---|---|--- 2026-08-13 12:45:03+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-2...

CVE-2026-73618

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73617

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0

Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...