| Sep 24 | PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding High7.5Sep 24 | High7.5 | 4.18.2 |
| Sep 24 | PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimitersHigh8.3Sep 24 | High8.3 | 4.18.2 |
| Sep 24 | MongoDB: improper input validationMedium5.3Sep 24 | Medium5.3 | 4.18.2 |
| Sep 24 | Improper neutralization of special elements in data query logic in the cache...High7.1Sep 24 | High7.1 | 5.11.0 |
| Sep 24 | MongoDB Compass: code injectionHigh7.3Sep 24 | High7.3 | 1.49.12 |
| Sep 24 | Heap buffer overflow via mid-scan command list growth in client topology monitoringHigh8.3Sep 24 | High8.3 | 1.30.12+1 more |
| Sep 24 | PHP object injection via unsuppressible __pclass class inference in command monitoring eventsMedium6.3Sep 24 | Medium6.3 | 1.21.10+2 more |
| Sep 18 | MongoDB Mongoid: unsafe reflectionCritical9.2Sep 18 | Critical9.2 | No fix yet |
| Sep 18 | MongoDB Mongoid: information disclosureHigh7.1Sep 18 | High7.1 | No fix yet |
| Sep 18 | MongoDB Mongoid: cleartext storageHigh7.1Sep 18 | High7.1 | No fix yet |
| Sep 18 | MongoDB Mongoid: code injectionHigh8.8Sep 18 | High8.8 | No fix yet |
| Sep 18 | Mongoid does not restrictHigh8.3Sep 18 | High8.3 | No fix yet |
| Sep 18 | MongoDB Mongoid: regular expression denial of serviceHigh8.7Sep 18 | High8.7 | No fix yet |
| Sep 18 | MongoDB Mongoid: insecure direct object referenceHigh8.6Sep 18 | High8.6 | No fix yet |
| Sep 18 | MongoDB Mongoid: unsafe reflectionHigh8.3Sep 18 | High8.3 | No fix yet |
| Sep 18 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamHigh8.1Sep 18 | High8.1 | 1.30.11+1 more |
| Sep 17 | Insertion of Sensitive Information into Log FileMedium5.7Sep 17 | Medium5.7 | 8.4.4 |
| Sep 17 | Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core providerMedium6.8Sep 17 | Medium6.8 | 8.4.4 |
| Sep 17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to...Medium6.3Sep 17 | Medium6.3 | 2.3.2 |
| Sep 17 | MongoDB C Driver: integer overflowMedium6.9Sep 17 | Medium6.9 | 2.3.1 |
| Sep 17 | MongoDB Entity Framework Core Provider: missing encryptionMedium6.8Sep 17 | Medium6.8 | 8.4.3+2 more |
| Sep 15 | RUBY-3941 Require exact match when reading/writing GridFS via IDMedium6.1Sep 15 | Medium6.1 | 2.26.0 |
| Sep 15 | PYTHON-5994 Use exact match for file ID in GridFS delete methodsMedium6.1Sep 15 | Medium6.1 | 4.18.1 |
| Sep 11 | MongoDB Server: race conditionHigh7.7Sep 11 | High7.7 | 8.3.11+2 more |
| Sep 11 | ### Impact Improper neutralization of special elements in data query logic in...High7.1Sep 11 | High7.1 | 5.11.0 |
| Sep 11 | ### Impact Improper neutralization of special elements in data query logic in...High7.1Sep 11 | High7.1 | 5.11.0 |
| Sep 11 | ### Impact Improper neutralization of special elements in data query logic in...High8.4Sep 11 | High8.4 | 5.11.0 |
| Sep 11 | GridFS data disclosure and deletion via query-operator injection in file IDsMedium6.1Sep 11 | Medium6.1 | 1.21.5+1 more |
| Sep 11 | GridFS data disclosure and deletion via query-operator injection in file IDsMedium6.1Sep 11 | Medium6.1 | 4.5.3 |
| Sep 11 | Heap buffer overflow via wrapped size check during SASL username canonicalizationMedium5.7Sep 11 | Medium5.7 | 2.5.3 |
| Sep 11 | GridFS data disclosure and deletion via query-operator injection in file IDsMedium6.1Sep 11 | Medium6.1 | 1.30.10+1 more |
| Sep 10 | Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java DriverHigh8.2Sep 10 | High8.2 | 5.11.1+1 more |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverHigh8.3Sep 10 | High8.3 | 5.11.1+1 more |
| Sep 10 | Regular expression injection via unescaped characters in LINQ query translationHigh7.1Sep 10 | High7.1 | 3.11.2 |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDsMedium6.1Sep 10 | Medium6.1 | 3.11.2 |
| Sep 10 | GridFS data deletion via operator-document injection in file IDsMedium6.1Sep 10 | Medium6.1 | 1.17.10+1 more |
| Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDsMedium6.1Sep 10 | Medium6.1 | 3.9.1 |
| Sep 8 | MongoDB Server: weakly protected credentialsHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of serviceHigh7.2Sep 8 | High7.2 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorizationHigh7.1Sep 8 | High7.1 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorizationHigh7.1Sep 8 | High7.1 | 8.0.30+1 more |
| Sep 8 | MongoDB Server: resource exhaustionHigh8.7Sep 8 | High8.7 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: integer overflowHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: use after freeMedium6.0Sep 8 | Medium6.0 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of serviceHigh8.7Sep 8 | High8.7 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of serviceHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: out-of-bounds readMedium5.3Sep 8 | Medium5.3 | 8.3.9+2 more |
| Sep 8 | Improper handling of case sensitivity in the configuration validation component...Critical9.2Sep 8 | Critical9.2 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: reachable assertionHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: user could access unredacted search query textMedium5.1Sep 8 | Medium5.1 | 8.3.9 |
| Sep 8 | MongoDB Server: type confusionHigh7.1Sep 8 | High7.1 | 8.3.9 |
| Sep 8 | MongoDB Server: authenticated user could crash the mongod serverHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of serviceMedium6.0Sep 8 | Medium6.0 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: authenticated user could store documents with speciallyLow2.3Sep 8 | Low2.3 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: use after freeHigh7.2Sep 8 | High7.2 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorizationHigh7.0Sep 8 | High7.0 | 8.3.9 |
| Sep 8 | MongoDB Server: improper access controlHigh7.6Sep 8 | High7.6 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: resource exhaustionHigh7.1Sep 8 | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: null pointer dereferenceHigh7.1Sep 8 | High7.1 | 8.3.9 |
| Sep 8 | MongoDB Server: race conditionMedium6.0Sep 8 | Medium6.0 | 8.3.9+2 more |