PT-2026-70850

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

PT-2026-70848

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...

PT-2026-70936

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

PT-2026-70846

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...

CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

ROOT-APP-NPM-GHSA-MH5C-679W-HH4R GHSA-mh5c-679w-hh4r in mongodb - Patched by Root

Root has patched GHSA-mh5c-679w-hh4r in the mongodb package for Root:npm. Multiple fixed versions available...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121

The CVE-2026-48121 vulnerability affects @langchain/langgraph-checkpoint-mongodb (MongoDBSaver) and involves NoSQL parameter injection in MongoDB queries. Versions 1.3.0 and earlier pass checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable directly into MongoD...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod package within MongoDB. Vulnerability Details CVEID:CVE-2026-6914 DESCRIPTION: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. Thi...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2026-42342)

Summary There are vulnerabilities in react-router-7.14.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42342. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-42342 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.x o...

Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting, Prototype Pollution (CVE-2026-8656, CVE-2026-8657)

Summary There are vulnerabilities in jsondiffpatch-0.7.3.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-8656, CVE-2026-8657. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-8656 DESCRIPTION: Versions of the package jsondiffpatch before 0.7.6 are...

Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-6322)

Summary There are vulnerabilities in fast-uri-3.0.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-6322. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encoded authority delimiters inside the ho...

CLEANSTART-2026-ME36767 Security fixes in mongodb 8.0.20-r1

Package mongodb version 8.0.20-r1 fixes 32 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820...

CLEANSTART-2026-BT73542 Security fixes in mongodb 8.1.3-r0

Package mongodb version 8.1.3-r0 fixes 3 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2026-2303...

CLEANSTART-2026-KV82275 Security fixes in mongodb 8.0.19-r0

Package mongodb version 8.0.19-r0 fixes 3 vulnerabilities: CVE-2026-27142, CVE-2026-27139, CVE-2026-25679...

CLEANSTART-2026-DI61732 Security fixes in prometheus-mongodb-exporter 0.47.2-r1

Package prometheus-mongodb-exporter version 0.47.2-r1 fixes 14 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186...