PT-2026-111668

🚨 CVE-2026-96297 Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Becau...

PT-2026-111653

🚨 CVE-2026-103965 An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not...

PT-2026-111654

🚨 CVE-2026-104004 MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access...

PT-2026-111549

Name of the Vulnerable Software and Affected Versions Parse Server versions 5.4.0 through 8.6.95 Parse Server versions 9.0.0 through 9.10.2-alpha.4 Description Transactional batch state is shared across concurrent requests, allowing a transactional batch request from one client to interfere with...

PT-2026-111655

Name of the Vulnerable Software and Affected Versions MongoDB mongos affected versions not specified Description An issue in the sharded cluster router allows an authenticated user with readWrite privileges to cause a denial of service by crafting a specially formed aggregation pipeline. This...

PT-2026-111669

🚨 CVE-2026-96299 A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks prop...

CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109426 Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

EUVD-2026-97910

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

Exploit for Missing Authorization in Mongodb

CVE-2026-13078 POC Original PoC coded and developed by Ad3M...

CVE-2026-109426: Cleartext Storage of Sensitive Information

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

mongoaudit

mongoaudit es una herramienta CLI para auditar servidores MongoDB, detectar configuraciones de seguridad deficientes y realizar pruebas de penetración automatizadas. Instalación Clona este repositorio y ejecuta la configuración: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit...

cve-search

cve-search cve-search es una herramienta para importar CVE Common Vulnerabilities and Exposures y CPE Common Platform Enumeration en una MongoDB para facilitar la búsqueda y el procesamiento de CVEs. El objetivo principal del software es evitar realizar búsquedas directas y públicas en las bases ...

mongobleed

mongobleed CVE-2025-14847 - Explotación de fuga de memoria no autenticada en MongoDB Un exploit de prueba de concepto para la vulnerabilidad de descompresión zlib de MongoDB que permite a atacantes no autenticados filtrar memoria sensible del servidor. Vulnerabilidad Un fallo en la descompresión...

steamer

Steamer Importa, gestiona y busca volcados públicos. ¿Tienes cantidades masivas de CSV, .sql, .txt que contengan credenciales, contraseñas y hashes? ¡Usa Steamer para gestionarlos! Cárgalos en una base de datos MongoDB, y ya sea usa la consola directamente, o simplemente usa la práctica interfaz...

xvna

XVNA Aplicación Node Extremadamente Vulnerable XVNA es una aplicación node extremadamente vulnerable codificada en NodejsExpressjs/MongoDB que ayuda a los entusiastas de la seguridad a aprender seguridad en aplicaciones. No se recomienda alojar esta aplicación en línea ya que está diseñada para s...

Linux Distros Unpatched Vulnerability : CVE-2026-106438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over- precision inputs containing leading zeros instead of...

Linux Distros Unpatched Vulnerability : CVE-2026-106431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at ...

Linux Distros Unpatched Vulnerability : CVE-2026-107324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON...

Linux Distros Unpatched Vulnerability : CVE-2026-106437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can...