Zlib compressed protocol header length confusion may allow memory read

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure

Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution

Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

FlatBSON Duplicate Field Index Drift

ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

Heap out-of-bounds write via signed size overflow in BSON document encoding

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections

Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption

Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access

MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output

MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories

MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories

Accessing Untrusted Directory May Allow Local Privilege Escalation

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run…

Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader