CO
Product
Compass
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 2Low 0
Watch
Add Compass to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6376 | 9.8 | Jul 1 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling Affected: before 1.42.2 |
| CVE-2026-14881 | 7.8 | Jul 22 | Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow Affected: 1.38.0 before 1.49.7 |
| CVE-2025-1755 | 7.8 | Feb 27 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges,… Affected: before 1.42.1 |
| CVE-2021-20334 | 7.8 | Apr 6 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running… Affected: 1.3.0 before 1.25.0 |
| CVE-2024-3371 | 6.8 | Apr 24 | MongoDB Compass may accept and use insufficiently validated input from an untrusted external source Affected: 1.35.0 before 1.42.1 |
| CVE-2026-9101 | 4.3 | May 20 | Prototype pollution in csv parsing Affected: 1.36.3; 1.36.4; 1.37.0; 1.38.0; 1.38.1; 1.38.2; +34 more |
Showing 6