p PatchFirst

PatchFirst · Latest vulnerabilities

mongodb/mongodb vulnerabilities

Vulnerabilities published for mongodb/mongodb in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-88023

    Medium · CVSS 6.1EPSS 0.33%Fix available

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    mongodb/mongodb mongodb/mongodbPHP
    • Update to 1.24.5
    • Update to 2.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-81525

    High · CVSS 8.6EPSS 0.49%Fix available

    Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

    The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

    mongodb/mongodb mongodb/mongodbPHP
    • Update to 1.21.4
    • Update to 2.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2021-32050

    Medium · CVSS 4.2EPSS 0.65%Fix available

    Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application

    Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB

    mongodb/mongodbPHP
    • Update to 1.9.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →