MO
Vendor
mongoosejs
6
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42334 | MO Mongoose Mongoosejs | 7.5 | May 14 | Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection |
| CVE-2025-23061 | MO Mongoose mongoosejs | 9.8 | Jan 15 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection |
| CVE-2024-53900 | MO Mongoose Mongoosejs | 9.1 | Dec 2 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection |
| CVE-2023-3696 | MO Mongoose Mongoosejs | 9.8 | Jul 17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4 |
| CVE-2022-2564 | MO Mongoose Mongoosejs | 9.8 | Jul 28 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6 |
| CVE-2019-17426 | MO Mongoose Mongoosejs | 9.1 | Oct 10 | Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored |