CVE-2024-7553

CVE-2024-7553 concerns MongoDB components (Server and relevant drivers) on Windows, due to incorrect validation of files loaded from a local untrusted directory. The flaw can enable local privilege escalation and may cause the application to execute arbitrary behavior based on untrusted file cont...

CVE-2026-81525

CVE-2026-81525 is a cross-tenant database retargeting vulnerability in the MongoDB client library for PHP (mongo-php-library and mongo-php-driver). The root cause is insufficient sanitization of dot and NUL characters in application-supplied namespace identifiers, allowing an attacker with low pr...

CVE-2025-12119

CVE-2025-12119 affects the MongoDB C driver: when using a bulk operation, mongoc_bulk_operation_t may read invalid memory if large options are passed. Connected advisories confirm the issue in the mongo-c-driver and reference Debian’s fix in version 1.17.6-1+deb11u2 for bullseye. Other listings (...