7142 matches found
EUVD-2026-108328
A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...
CVE-2026-114654
A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...
CVE-2026-114653 Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...
CVE-2026-114653
The MongoDB C# Driver contains a vulnerability in its client-side encryption schema construction component. The driver fails to normalize or validate caller-supplied field identifiers, placing them into a position where they are interpreted as pattern expressions . This can cause client-side fiel...
EUVD-2026-108325
A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...
CVE-2026-114652
The MongoDB C# Driver contains a data-query-logic neutralization weakness within the update-statement construction component . This vulnerability allows an attacker who can influence application-supplied values to have those values interpreted as query/update logic rather than literal data. A use...
CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
EUVD-2026-108323
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...
CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer
A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...
EUVD-2026-108322
A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...
CVE-2026-114651
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver allows for potential data leakage. By providing specially crafted serialized input, an unauthenticated party can cause the application to return residual bytes from unrelated data processed earlier on the sa...
CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
CVE-2026-114650
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause sensitive data designated for client-side field-level encryption to be written in plaintext . Under specific platform text-encoding configurations, an internal name conversion loses information, causing the encry...
EUVD-2026-108319
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
EUVD-2026-108317
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
CVE-2026-114649
The MongoDB C# Driver is vulnerable to an authentication bypass due to insufficient certificate validation when managing cached connections. The driver incorrectly compares TLS client certificates using only the issuer and serial number . An attacker can provide a certificate mimicking another us...
CVE-2026-114648
The MongoDB C# Driver is vulnerable to a NoSQL injection flaw because it fails to neutralize dot (.) and dollar ($) characters in dictionary keys, field names, and array-filter identifiers used in LINQ queries . When user input reaches these positions, an attacker can redirect queries or updates ...
CVE-2026-114648 NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
The MongoDB C Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or...
EUVD-2026-108315
The MongoDB C Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or...