Azure Linux 3.0 Security Update: wireshark (CVE-2024-4854)

The version of wireshark installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4854 advisory. - MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to...

Debian: Security Advisory (DLA-4438-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4438-1] mongo-c-driver security update

Debian LTS Advisory DLA-4438-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez January 14, 2026 https://wiki.debian.org/LTS Package : mongo-c-driver Version : 1.17.6-1+deb11u2 CVE ID : CVE-2025-12119 A vulnerability has been discovered in mongo-c-driver, the...

Debian dla-4438 : libbson-1.0-0 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4438 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4438-1 [email protected] https://www.debian.org/lts/security/...

DLA-4438-1 mongo-c-driver - security update

Bulletin has no description...

OESA-2025-2890 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

MongoBleed CVE-2025-14847: Critical Memory Leak in MongoDB Allowing Attackers to Extract Sensitive Data

Overview On December 19, 2025, MongoDB Inc. disclosed a critical new vulnerability, CVE-2025-14847, which has since been dubbed MongoBleed. This vulnerability is a high-severity unauthenticated memory leak affecting MongoDB, one of the world's most popular document-oriented databases. While...

Exploit for CVE-2025-14847

Eric Capuano^1 posted an excellent blog regarding Mongo...

PT-2025-53630

@Forbiddentwo2 It seems the post was deleted. I couldn't find any confirmed reports of Ubisoft's source code being leaked via MongoBleed, which is a newly disclosed MongoDB vulnerability CVE-2024-14847. The author may have removed it if the claim was unverified...

CVE-2025-14847

MongoDB vulnerability CVE-2025-14847 (MongoBleed) arises from mismatched length fields in zlib decompression headers, allowing unauthenticated read of uninitialized heap memory. Affected versions include MongoDB Server 3.6.x and 4.x lines (various latest vulnerable builds), 5.0.x, 6.0.x, 7.0.x, 8...

BIT-MONGODB-2025-12657 Malformed KMIP response may result in access violation

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations...

OESA-2025-2823 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2821 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

Malicious Package

Overview mongo-decimal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192414 Malicious code in mongo-decimal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31ef468b36fa90f39d081db22602ad19c8c84bfa3416e3b471eebaaad2919bf The package mongo-decimal was found to contain malicious code. Source: ghsa-malware e32897d62825ec82598cd1de92099161013a0fc84c60add6ec1c9496320ab58d...

Malicious code in mongo-decimal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31ef468b36fa90f39d081db22602ad19c8c84bfa3416e3b471eebaaad2919bf The package mongo-decimal was found to contain malicious code. Source: ghsa-malware e32897d62825ec82598cd1de92099161013a0fc84c60add6ec1c9496320ab58d...

EUVD-2025-202363

Malicious code in mongo-decimal npm...

CVE-2025-13507

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

TencentOS Server 4: wireshark (TSSA-2025:0858)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0858 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-12119

CVE-2025-12119 affects the MongoDB C driver: when using a bulk operation, mongoc_bulk_operation_t may read invalid memory if large options are passed. Connected advisories confirm the issue in the mongo-c-driver and reference Debian’s fix in version 1.17.6-1+deb11u2 for bullseye. Other listings (...