CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

ROOT-APP-NPM-GHSA-MH5C-679W-HH4R GHSA-mh5c-679w-hh4r in mongodb - Patched by Root

Root has patched GHSA-mh5c-679w-hh4r in the mongodb package for Root:npm. Multiple fixed versions available...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121

The CVE-2026-48121 vulnerability affects @langchain/langgraph-checkpoint-mongodb (MongoDBSaver) and involves NoSQL parameter injection in MongoDB queries. Versions 1.3.0 and earlier pass checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable directly into MongoD...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CLEANSTART-2026-DY40208 Security fixes in mongodb 8.0.23-r2

Package mongodb version 8.0.23-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-ZI28636 Security fixes in mongodb 8.2.6-r2

Package mongodb version 8.2.6-r2 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-BT73542 Security fixes in mongodb 8.1.3-r0

Package mongodb version 8.1.3-r0 fixes 3 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2026-2303...

CLEANSTART-2026-KV82275 Security fixes in mongodb 8.0.19-r0

Package mongodb version 8.0.19-r0 fixes 3 vulnerabilities: CVE-2026-27142, CVE-2026-27139, CVE-2026-25679...

CLEANSTART-2026-DI61732 Security fixes in prometheus-mongodb-exporter 0.47.2-r1

Package prometheus-mongodb-exporter version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-KI83481 Security fixes in prometheus-mongodb-exporter-fips 0.47.2-r1

Package prometheus-mongodb-exporter-fips version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...

CLEANSTART-2026-CN16573 Security fixes in percona-server-mongodb-operator 1.22.0-r1

Package percona-server-mongodb-operator version 1.22.0-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-IV17968 Security fixes in mongodb 7.0.32-r1

Package mongodb version 7.0.32-r1 fixes 19 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-IB04724 Security fixes in mongodb 7.0.34-r2

Package mongodb version 7.0.34-r2 fixes 1 vulnerabilities: CVE-2026-42504...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...

MongoDB 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-125872)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...