https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:52:12.695309+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mongodb-2026-84967 BIT-mongodb-2026-84967 — Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal 2026-10-03T05:52:12.754630+00:00

Affected: Bitnami: mongodb

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1123 certfr-2026-avi-1123 — De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-03T05:52:12.754692+00:00 certfr-2026-avi-1123 https://cve.radiocsirt.org/vuln/euvd-2026-363513 EUVD-2026-363513 2026-10-03T05:52:12.754713+00:00 EUVD-2026-363513 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84967 fkie_cve-2026-84967 2026-10-03T05:52:12.754726+00:00

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

 https://cve.radiocsirt.org/vuln/ghsa-xc56-7hjg-wv9v GHSA-xc56-7hjg-wv9v 2026-10-03T05:52:12.754752+00:00

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3209 WID-SEC-W-2026-3209 — MongoDB: Mehrere Schwachstellen 2026-10-03T05:52:12.754771+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service zu verursachen, Daten zu manipulieren, Informationen offenzulegen oder beliebige Befehle über die MongoDB-Erweiterung für Visual Studio Code auszuführen.