EUVD-2026-120497

Mongoose: Discriminator key values matching inherited properties e.g. t: 'constructor' bypass schema casting and can poison collections...

CVE-2026-125116

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

CVE-2026-125116

The Mongoose MongoDB object modeling tool is vulnerable to type confusion due to the use of attacker-controlled discriminator key values (including the default __t field) to index registries like Model.discriminators. Because Mongoose does not require an own property, values like constructor, toS...

PT-2026-141160

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

CVE-2026-125116: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

SUSE CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-81521

A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...

Linux Distros Unpatched Vulnerability : CVE-2026-81521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping ...

DEBIAN-CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

UBUNTU-CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-81521

CVE-2026-81521 affects the MongoDB Go Driver's Client.BulkWrite API . When a caller-supplied database name contains a reserved separator character (dot) that is not escaped before being used to build the target namespace, a write operation can be redirected to an unintended database and collectio...

CVE-2026-81521 Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-81521 Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...