https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-120955/https://vulnfeed.org/cve/CVE-2026-120955/Tue, 03 Nov 2026 18:42:39 +0000The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.https://vulnfeed.org/cve/CVE-2026-120956/https://vulnfeed.org/cve/CVE-2026-120956/Tue, 03 Nov 2026 18:41:44 +0000The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.https://vulnfeed.org/cve/CVE-2026-120678/https://vulnfeed.org/cve/CVE-2026-120678/Tue, 03 Nov 2026 18:39:32 +0000A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.https://vulnfeed.org/cve/CVE-2026-114648/https://vulnfeed.org/cve/CVE-2026-114648/Thu, 22 Oct 2026 19:17:38 +0000The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.https://vulnfeed.org/cve/CVE-2026-114644/https://vulnfeed.org/cve/CVE-2026-114644/Thu, 22 Oct 2026 19:13:48 +0000The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.