CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB. Vulnerability Details CVEID:CVE-2026-6914 DESCRIPTION: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. Thi...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2026-42342)

Summary There are vulnerabilities in react-router-7.14.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42342. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-42342 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.x o...

Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting, Prototype Pollution (CVE-2026-8656, CVE-2026-8657)

Summary There are vulnerabilities in jsondiffpatch-0.7.3.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-8656, CVE-2026-8657. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-8656 DESCRIPTION: Versions of the package jsondiffpatch before 0.7.6 are...

Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-6322)

Summary There are vulnerabilities in fast-uri-3.0.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-6322. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encoded authority delimiters inside the ho...

CLEANSTART-2026-ME36767 Security fixes in mongodb 8.0.20-r1

Package mongodb version 8.0.20-r1 fixes 32 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820...

CLEANSTART-2026-ZI28636 Security fixes in mongodb 8.2.6-r2

Package mongodb version 8.2.6-r2 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-DY40208 Security fixes in mongodb 8.0.23-r2

Package mongodb version 8.0.23-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-HD27625 Security fixes in mongodb 8.1.3-r1

Package mongodb version 8.1.3-r1 fixes 1 vulnerabilities: CVE-2026-46600...

CLEANSTART-2026-DI61732 Security fixes in prometheus-mongodb-exporter 0.47.2-r1

Package prometheus-mongodb-exporter version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-KI83481 Security fixes in prometheus-mongodb-exporter-fips 0.47.2-r1

Package prometheus-mongodb-exporter-fips version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-KV82275 Security fixes in mongodb 8.0.19-r0

Package mongodb version 8.0.19-r0 fixes 3 vulnerabilities: CVE-2026-27142, CVE-2026-27139, CVE-2026-25679...

CLEANSTART-2026-BT73542 Security fixes in mongodb 8.1.3-r0

Package mongodb version 8.1.3-r0 fixes 3 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2026-2303...

CLEANSTART-2026-IB04724 Security fixes in mongodb 7.0.34-r2

Package mongodb version 7.0.34-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-IV17968 Security fixes in mongodb 7.0.32-r1

Package mongodb version 7.0.32-r1 fixes 19 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-CN16573 Security fixes in percona-server-mongodb-operator 1.22.0-r1

Package percona-server-mongodb-operator version 1.22.0-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-OW39793 Security fixes in mongodb 8.2.1-r1

Package mongodb version 8.2.1-r1 fixes 3 vulnerabilities: CVE-2025-61727, CVE-2025-58181, CVE-2025-14847...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...