Veille CVE

Mercredi 12 août 2026

7 CVE

Critique 1 Élevée 2 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « MongoDB Go Driver » ✕
  1. CVE-2026-19503 6.5 Moyenne

    MongoDB Atlas SQL ODBC Driver · MongoDB Schema Builder CLI · Mongodb odbc driver · Mongodb sql schema builder cli

    MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

  2. CVE-2026-19004 8.1 Élevée

    MongoDB BI Connector ODBC Driver

    An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

  3. CVE-2026-19002 8.1 Élevée

    MongoDB BI Connector ODBC Driver

    A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

  4. CVE-2026-19001 9.8 Critique

    MongoDB BI Connector ODBC Driver

    The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

  5. CVE-2026-18888 6.5 Moyenne

    MongoDB BI Connector ODBC Driver

    The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

  6. CVE-2026-73409 5.1 Moyenne

    budibase

    Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.

  7. CVE-2026-18710 6.5 Moyenne

    MongoDB Driver · Mongodb java driver

    A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.