CPE
high
advisory
Mongoose: Connection-level sanitizeFilter bypass (CVE-2026-125119)
1 TTP 1 CVEA bug in Mongoose allows MongoDB query selector injection due to the failure of connection-level sanitizeFilter configurations to apply, potentially enabling unauthorized record access.
Mongoose +3
web-application
database-security
injection
mongodb
1t
1c
critical
advisory
Mongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)
1 TTP 1 CVEMongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.
mongoose +3
1t
1c