446 matches found
Improper Handling of URL Encoding (Hex Encoding)
Overview Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding in validateuri and parsesrv, which apply unquoteplus to the entire host section of a connection string before splitting it on , and :, so a percent-encoded delimiter decodes into a real one...
CVE-2026-96748
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...
academic-metrics (>=0.1.0b0, <=1.0.99), accomate (>=1.0.4, <=2.0.0.6) +1311 more potentially affected by CVE-2026-96747 via pymongo (>=3.9.0, <=4.18.1)
pymongo PYPI version =3.9.0, =0.1.0b0, =1.0.4, =0.9.0, =0.3.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =2022.9.19, =0.22.0, =0.3.0, =1.2.0 and more Source cves: CVE-2026-96747 Source advisory: MEND:CVE-2026-96747...
academic-metrics (>=0.1.0b0, <=1.0.99), accomate (>=1.0.4, <=2.0.0.6) +1311 more potentially affected by CVE-2026-96747 via pymongo (>=3.9.0, <=4.18.1)
pymongo PYPI version =3.9.0, =0.1.0b0, =1.0.4, =0.9.0, =0.3.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =2022.9.19, =0.22.0, =0.3.0, =1.2.0 and more Source cves: CVE-2026-96747 Source advisory: SNYK:PYTHON-PYMONGO-20158824...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in EncryptionIO.kmsrequest and EncryptionIO.fetchkeys, which pass the endpoint through parsehost and on to createconnection unchanged when it ends in .sock, so the connection code interprets it as a Unix...
CVE-2026-96748
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...
PT-2026-98232
Name of the Vulnerable Software and Affected Versions PyMongo affected versions not specified Description Connection string parsing decodes percent-encoded characters in the host portion before the host list is separated by its delimiters. If an application incorporates a hostname provided by an...
PT-2026-105028
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...
CVE-2026-96748: Improper Handling of URL Encoding (Hex Encoding)
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...
OPENSUSE-SU-2026:11808-1 python313-pymongo-4.18.1-1.1 on GA media
These are all security issues fixed in the python313-pymongo-4.18.1-1.1 package on the GA media of openSUSE Tumbleweed...
Astra Linux – Vulnerability in pymongo
A out-of-bounds read in the ‘bson’ module of PyMongo 4.6.2 or earlier allows for deserialization of malformed BSON data provided by the server, which can trigger an exception that may contain arbitrary application memory...
Duplicate Advisory: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8fvv-fgr5-f8ch. This link is maintained to preserve external references. Original Description Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver...
GHSA-8H2C-GHFF-MPG9 Duplicate Advisory: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8fvv-fgr5-f8ch. This link is maintained to preserve external references. Original Description Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver...
2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1409 more potentially affected by CVE-2026-88029 via pymongo (>=2.4.1, <=4.18.0)
pymongo PYPI version =2.4.1, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-88029 Source advisory: MEND:CVE-2026-88029...
2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1409 more potentially affected by CVE-2026-88029 via pymongo (>=2.4.1, <=4.18.0)
pymongo PYPI version =2.4.1, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-88029 Source advisory: SNYK:PYTHON-PYMONGO-20158803...
Improper Neutralization of Special Elements in Data Query Logic
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic using NoSQL operators in the GridFS file identifier handling in gridfs/synchronous/gridfile.py, gridfs/asynchronous/gridfile.py, and gridfs/gridfileshared.py, where delete,...
python313-pymongo-4.17.0-1.1 on GA media (moderate)
python313-pymongo-4.17.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11478-1 Rating: moderate Cross-References: CVE-2013-2132 CVE-2024-21506 CVSS scores: CVE-2024-21506 SUSE : 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L Affected Products: openSUSE Tumbleweed An update that solves 2...
PT-2026-76404
These are all security issues fixed in the python313-pymongo-4.17.0-1.1 package on the GA media of openSUSE Tumbleweed...