CVE alerts for
MongoDB
CVEye scans every new CVE and notifies your team the moment MongoDB is affected — before attackers can exploit it.
Recent MongoDB CVEs
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
Never miss a MongoDB vulnerability
CVEye monitors MongoDB and your entire stack 24/7, sending instant alerts via email, Slack, Discord, or webhook the moment a new CVE is published.
7-day free trial · No credit card required