CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-3085 – MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked
https://notcve.org/view.php?id=CVE-2025-3085
01 Apr 2025 — A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 version... • https://jira.mongodb.org/browse/SERVER-95445 • CWE-299: Improper Check for Certificate Revocation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-3084 – MongoDB Server may crash due to improper validation of explain command
https://notcve.org/view.php?id=CVE-2025-3084
01 Apr 2025 — When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4 • https://jira.mongodb.org/browse/SERVER-103153 • CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-3083 – Malformed MongoDB wire protocol messages may cause mongos to crash
https://notcve.org/view.php?id=CVE-2025-3083
01 Apr 2025 — Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16 Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior t... • https://jira.mongodb.org/browse/SERVER-103152 • CWE-248: Uncaught Exception •
CVSS: 3.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-3082 – User may override a view's collation and gain unauthorized access to underlying data
https://notcve.org/view.php?id=CVE-2025-3082
01 Apr 2025 — A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4. • https://jira.mongodb.org/browse/SERVER-103151 • CWE-284: Improper Access Control •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2025-0755 – MongoDB C Driver bson library may be susceptible to buffer overflow
https://notcve.org/view.php?id=CVE-2025-0755
18 Mar 2025 — The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16 • https://jira.mongodb.org/browse/SERVER-94461 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1756 – MongoDB Shell may be susceptible to local privilege escalation in Windows
https://notcve.org/view.php?id=CVE-2025-1756
27 Feb 2025 — mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0 • https://jira.mongodb.org/browse/MONGOSH-2028 • CWE-426: Untrusted Search Path •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1755 – MongoDB Compass may be susceptible to local privilege escalation in Windows
https://notcve.org/view.php?id=CVE-2025-1755
27 Feb 2025 — MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1 • https://jira.mongodb.org/browse/COMPASS-9058 • CWE-426: Untrusted Search Path •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1693 – MongoDB Shell may be susceptible to control character Injection via shell output
https://notcve.org/view.php?id=CVE-2025-1693
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. This is... • https://jira.mongodb.org/browse/MONGOSH-2026 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1692 – MongoDB Shell may be susceptible to control character injection via pasting
https://notcve.org/view.php?id=CVE-2025-1692
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9 • https://jira.mongodb.org/browse/MONGOSH-2025 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1691 – MongoDB Shell may be susceptible to Control Character Injection via autocomplete
https://notcve.org/view.php?id=CVE-2025-1691
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or... • https://jira.mongodb.org/browse/MONGOSH-2024 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •