A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch

A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner

A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for…

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings

Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

KMS request injection via unsanitized key vault and provider values in libmongocrypt

Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

Authenticate command with specific mechanism parameter can trigger server crash

Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

PHP object injection via unsuppressible __pclass class inference in command monitoring events

KMS master key exposure via unredacted credential serialization in driver settings string

Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds

BSON element injection via NUL-embedded document keys in builder append

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

Keyfile contents are in MongoDB Server logs

Sensitive data could be written to mongod.log

Malformed KMIP response may result in access violation

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file

MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files

Duplicate geometry fields via unvalidated GeoJSON extra members

Fixed values in MongoDB Server $bucket stage may be misread as field references

Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

NoSQL injection via array replacement bypassing update shape validation in driver write path

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data

Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service

Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service

Heap out-of-bounds read via corrupt nested BSON in field path error message

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination