MongoDB Mongosql Transition Readiness Tool vulnerabilities

3 CVEs affecting MongoDB Mongosql Transition Readiness Tool, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76798, published 2026-08-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-76797, published 2026-08-28. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A…
CVE-2026-76798, published 2026-08-28. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to…
CVE-2026-76794, published 2026-08-28. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause…