MC
Product
MongoDB Compass
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 2Low 0
Watch
Add MongoDB Compass to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6376 | 9.8 | Jul 1 | ejson shell parser in MongoDB Compass maybe bypassed Affected: before 1.42.2 |
| CVE-2026-14881 | 7.8 | Jul 22 | Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow Affected: 1.38.0 before 1.49.7 |
| CVE-2025-1755 | 7.8 | Feb 27 | MongoDB Compass may be susceptible to local privilege escalation in Windows Affected: before 1.42.1 |
| CVE-2021-20334 | 7.8 | Apr 6 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running… Affected: 1.3.0 before 1.25.0 |
| CVE-2024-3371 | 6.8 | Apr 24 | Insufficient validation of external input in Compass may enable MITM attacks Affected: 1.35.0 through 1.42.0 |
| CVE-2026-9101 | 4.3 | May 20 | Prototype pollution in csv parsing Affected: 1.36.3; 1.36.4; 1.37.0; 1.38.0; 1.38.1; 1.38.2; +34 more |
Showing 6