Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 7.6 | CVE-2026-115929 |
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store
electron, MongoDB, Inc.electron, MongoDB, Inc. MongoDB Compass
|
NVD | |||
|
CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store
Executive summaryThe advisory concerns MongoDB Compass, a desktop tool for MongoDB, whose TLS root certificate store comes from the bundled Electron runtime. The release notes say the issue was addressed by updating Electron, and the advisory does not state how severe the flaw is. The recommended action in the text is to use MongoDB Compass v1.53.1, which includes the updated Electron. Technical summaryThe advisory describes the flaw as a problem in Electron's own TLS root certificate store, which MongoDB Compass relies on. The vulnerability class, CVSS score, and attack vector are not stated. The fix is an Electron update included in MongoDB Compass 1.53.1, with the Electron v44.9.1 release notes cited as the reference for CVE-2026-115929. The affected Compass versions before 1.53.1 are not explicitly stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb-js/compass/releases/tag/v1.53.1 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.6 | CVE-2026-113870 |
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source
MongoDB, Inc.MongoDB, Inc. MongoDB Compass
|
NVD | |||
|
CVE-2026-113870MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source
From the advisoryMongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||