Schema validation log messages may not redact user data

Users could trigger a crash of mongod primaries during promotion to sharded

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory…

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting…

Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption

An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service

Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

Flaw in the updateUser Command May Allow Unauthorized Configuration Change

Stack memory disclosure in filemd5 command

profile command may permit unauthorized configuration

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the…

Cross-document data leak via malformed BSON array parsing in reused thread buffer