BIT-MONGODB-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

GO-2026-5021 vulnerabilities

Vulnerabilities for packages: mattermost-fips, argo-cd-fips, prometheus, prometheus-mongodb-exporter, argo-cd, vault-fips, terragrunt, vault, external-secrets-operator-fips, k3s, backup-restore-operator, etcd, omnictl-multiarch, knative-kafka-broker, kubernetes-fips, guac, telegraf, istio,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: step-issuer, cert-manager-csi-driver, percona-server-mongodb-operator, opentelemetry-operator, cert-manager-webhook-pdns, aws-privateca-issuer, mariadb-operator, cert-manager-istio-csr, cert-manager-cmctl...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: argo-rollouts, nri-couchbase, trino, ctop, frp, gostatsd, external-secrets-operator, aactl, tekton-chains, nri-mssql, flux, cluster-autoscaler, net-kourier, flyte, snyk-cli, cis-operator, sftpgo-plugin-auth, litefs, lazydocker, harbor,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: trivy, external-secrets-operator, kubernetes-dashboard-web, net-kourier, timescaledb-parallel-copy, snyk-cli, cis-operator, sftpgo-plugin-auth, kafka-proxy, grpc-health-probe, influx, yunikorn-k8shim, spark-operator, kubernetes-ingress-defaultbackend, pgtimetable,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-couchbase, ctop, frp, gostatsd, aactl, kube-vip-cloud-provider, cluster-autoscaler, ipfs-cluster, timescaledb-parallel-copy, minio, extism, nri-rabbitmq, secrets-store-csi-driver-provider-aws, sftpgo-plugin-auth, x509-certificate-exporter, docker-credential-gcr,...

EUVD-2026-58506

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-18888

creationtimestamp| type| source ---|---|--- 2026-08-13 12:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-2...

CVE-2026-19004

creationtimestamp| type| source ---|---|--- 2026-08-13 12:45:03+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-2...

CVE-2026-73617

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73618

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0

Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

EUVD-2026-57821

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73617 Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73617 Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73618

Budibase Server prior to 3.40.0 is affected by a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters, allowing attackers with query write permission to inject JSON structural characters...