Monthly
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unrestricted read, write, and delete access to the entire SOAR database in versions below 8.6.0. The vulnerability stems from user-supplied input being incorporated into database queries without proper sanitization (CWE-943), enabling arbitrary SQL execution against the SOAR backend. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Splunk has released a patch in version 8.6.0.
SPL injection in Splunk Enterprise below versions 10.2.6, 10.0.9, and 9.4.14 enables an unauthenticated attacker to execute arbitrary Search Processing Language commands under the privileges of any authenticated Splunk user by luring that user into clicking a specially crafted Splunk Web URL. The root cause is unsanitized substitution of URL-supplied form token values directly into SPL searches, effectively turning the victim's browser session into a proxy for the attacker's queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (C:H) makes this a meaningful data-exfiltration vector in targeted phishing scenarios against Splunk-heavy SOC or analytics environments.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
SQL injection in Splunk SOAR's playbook automation data APIs grants any user holding the 'Automation Engineer' role unrestricted read, write, and delete access to the entire SOAR database in versions below 8.6.0. The vulnerability stems from user-supplied input being incorporated into database queries without proper sanitization (CWE-943), enabling arbitrary SQL execution against the SOAR backend. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Splunk has released a patch in version 8.6.0.
SPL injection in Splunk Enterprise below versions 10.2.6, 10.0.9, and 9.4.14 enables an unauthenticated attacker to execute arbitrary Search Processing Language commands under the privileges of any authenticated Splunk user by luring that user into clicking a specially crafted Splunk Web URL. The root cause is unsanitized substitution of URL-supplied form token values directly into SPL searches, effectively turning the victim's browser session into a proxy for the attacker's queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (C:H) makes this a meaningful data-exfiltration vector in targeted phishing scenarios against Splunk-heavy SOC or analytics environments.