CVE Vulnerability Catalog

The ldapQueryPassword parameter, when set through the runtime setParameter command, is logged to the mongod.log file in plain text.

An authenticated MongoDB user can crash the server or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled fields and internal metadata.

When running an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery, if a single key range produces enough documents to fill its exchange buffer, the server reaches a code path where a full per-consumer buffer is detected but the internal high watermark for that key range is not updated as intended.

In MongoDB, the $_internalConvertBucketIndexStats stage uses PauseExecution as a signal to skip a document, but PauseExecution is only intended for coordinating sub-pipelines in $facet. When this stage is placed before $facet, TeeBuffer receives an unexpected signal and violates an assertion, crashing mongod.

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash the MongoDB server.

Using $changestreams and $_requestReshardingResumeToken with the exchange option causes an invariant violation, leading to a server crash. No special privileges are needed, but the user must be logged in.

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions being sent to the server as plaintext instead of ciphertext.

The MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, full authentication parameters are written without redaction.

In lldpd (IEEE 802.1ab LLDP implementation) before version 1.0.22, the lldpd_decode() function incorrectly calculates the shift size when stripping VLAN tags, leading to a heap buffer over-read. Fixed in version 1.0.22.

CAI Content Credentials libraries ([email protected], c2pa-v0.80.1 and earlier) are vulnerable to uncontrolled resource consumption. An attacker can exhaust system resources, causing application denial of service without user interaction.

Uncontrolled resource consumption vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can exhaust system resources, causing a denial of service (DoS). Exploitation does not require user interaction.

Improper input validation vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can crash the application, leading to a denial of service (DoS). Exploitation does not require user interaction.

Uncontrolled resource consumption vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can exhaust system resources, causing a denial of service (DoS). Exploitation does not require user interaction.

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by a Path Traversal vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation requires user interaction in that a victim must extract a maliciously crafted file.

Reflected XSS vulnerability in OSCAL-GUI allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to project_id without sanitization, then reflected in an error message without encoding.

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields.

Out-of-bounds read vulnerability in Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier). An attacker can leverage this to disclose sensitive memory contents. User interaction is required – the victim must open a malicious file.

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. The vulnerable component is restricted to an administrative network zone by default. Scope is changed.

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction – the victim must open a malicious file.