Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-76797

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector Transition Readiness Report Mongosql Transition Readiness Tool
CVE-2026-76798

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector Transition Readiness Report Mongosql Transition Readiness Tool
CVE-2026-76794

MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector Transition Readiness Report Mongosql Transition Readiness Tool