Mongodb vulnerabilities

Products

• Mongodb 188
• Server 95
• C Driver 21
• C Driver 19
• C# Driver 17
• Bi Connector 8
• Bi Connector 8
• Bi Connector Odbc Driver 8
• C\# Driver 8
• Compass 8
• Mongoid 8
• Php Driver 8
• Bi Connector Odbc Driver 7
• Libmongocrypt 7
• Ops Manager 7
• C++ Driver 5
• Database Tools 5
• Go Driver 5
• Php Driver 5
• Python Driver 5
• Rust Driver 5
• C\+\+ Driver 4
• Go Driver 4
• Java Driver 4
• Laravel Mongodb (php) 4
• Mongosh 4
• Rust Driver 4
• Atlas Sql Odbc Driver 3
• Bi Connector Transition Readiness Report 3
• Entity Framework Core Provider 3
• Java Driver 3
• Laravel Mongodb 3
• Libbson 3
• Mongosql Transition Readiness Tool 3
• Ops Manager 3
• Bson 2
• Js-bson 2
• Ops Manager Server 2
• Php Library 2
• Python Driver 2
• Schema Builder Cli 2
• Sql Schema Builder Cli 2

Newest

• mongodb atlas sql MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes CVE-2026-120959 2.1 LowNovember 3, 2026
• mongodb atlas sql odbc driver MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write CVE-2026-120952 6.0 MediumNovember 3, 2026
• mongodb entity framework core provider EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference CVE-2026-120567 2.3 LowNovember 3, 2026
• mongodb atlas sql jdbc driver Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler CVE-2026-120953 5.1 MediumNovember 3, 2026
• mongodb c driver Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views CVE-2026-120954 6.3 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata CVE-2026-120955 8.7 HighNovember 3, 2026
• mongodb c driver remote abort and memory disclosure from a malformed cursor.ns CVE-2026-120956 7.1 HighNovember 3, 2026
• mongodb c driver MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password CVE-2026-120684 6.0 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) CVE-2026-120678 8.7 HighNovember 3, 2026
• mongodb rust driver Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command CVE-2026-120673 6.8 MediumNovember 3, 2026
• mongodb database tools mongorestore may restore encoded collection names into an unintended collection CVE-2026-119674 2.1 LowNovember 3, 2026
• mongodb database tools mongofiles may write outside the working directory through a symlink CVE-2026-119673 1.0 LowNovember 3, 2026
• mongodb database tools mongofiles may disclose GridFS content to standard output through a stored filename CVE-2026-119672 5.9 MediumNovember 3, 2026
• mongodb database tools mongorestore may bypass collection guards through a system.buckets prefix CVE-2026-119675 5.2 MediumNovember 3, 2026
• mongodb node.js driver MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data CVE-2026-119179 8.3 HighNovember 3, 2026
• mongodb database tools The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs CVE-2026-116641 7.6 HighOctober 28, 2026
• mongodb java driver NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol CVE-2026-118581 6.9 MediumOctober 28, 2026
• mongodb laravel mongodb Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs CVE-2026-118510 7.7 HighOctober 28, 2026
• mongodb libmongocrypt KMS request injection via unsanitized key vault and provider values in libmongocrypt CVE-2026-114655 Fix available 6.0 MediumOctober 22, 2026
• mongodb c# driver BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards CVE-2026-114654 6.9 MediumOctober 22, 2026
• mongodb c# driver Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder CVE-2026-114653 7.1 HighOctober 22, 2026
• mongodb c# driver Update operator injection via single-element list rewriting in the update builder CVE-2026-114652 7.1 HighOctober 22, 2026
• mongodb c# driver Cross-document data leak via malformed BSON array parsing in reused thread buffer CVE-2026-114651 6.3 MediumOctober 22, 2026
• mongodb c# driver, mongodb.libmongocrypt nuget package +1 more Plaintext exposure of encrypted fields via ANSI code-page corruption of database name CVE-2026-114650 6.9 MediumOctober 22, 2026
• mongodb c# driver Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache CVE-2026-114649 7.6 HighOctober 22, 2026
• mongodb c# driver NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys CVE-2026-114648 7.2 HighOctober 22, 2026
• mongodb c# driver NoSQL operator injection via unvalidated replacement document in findOneAndReplace CVE-2026-114647 5.3 MediumOctober 22, 2026
• mongodb c# driver NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire CVE-2026-114646 6.9 MediumOctober 22, 2026
• mongodb c driver Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping CVE-2026-114645 Fix available 5.7 MediumOctober 22, 2026
• mongodb c# driver Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization CVE-2026-114644 8.2 HighOctober 22, 2026
• mongodb c# driver Duplicate geometry fields via unvalidated GeoJSON extra members CVE-2026-114643 5.3 MediumOctober 22, 2026
• hcl software compass Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing CVE-2026-113870 8.6 HighOctober 21, 2026
• mongodb server, mongodb, inc. mongodb server +1 more Incorrect authorization in MongoDB Server router for bulk writes to system namespaces CVE-2026-104005 7.1 HighOctober 13, 2026
• mongodb server, mongodb, inc. mongodb server +1 more Collection validators using collation-accepting expressions can crash MongoDB Server on insert CVE-2026-104004 7.1 HighOctober 13, 2026
• mongodb server, mongodb, inc. mongodb server +1 more Fixed values in MongoDB Server $bucket stage may be misread as field references CVE-2026-103965 5.3 MediumOctober 13, 2026
• mongodb server, mongodb, inc. mongodb server +1 more Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service CVE-2026-96299 7.1 HighOctober 13, 2026
• mongodb server, mongodb, inc. mongodb server +1 more MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline CVE-2026-96297 6.0 MediumOctober 13, 2026
• mongodb ops manager Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings CVE-2026-87109 6.0 MediumOctober 9, 2026
• mongodb ops manager Ops Manager Improper Authorization in Daily Host Monitoring Retrieval CVE-2026-87108 2.3 LowOctober 9, 2026
• mongodb ops manager Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints CVE-2026-87110 6.9 MediumOctober 9, 2026
• mongodb python driver Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver CVE-2026-106435 Fix available 5.9 MediumOctober 8, 2026
• mongodb php driver Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver CVE-2026-106436 Fix available 6.3 MediumOctober 8, 2026
• mongodb php driver Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver CVE-2026-106432 Fix available 2.0 LowOctober 8, 2026
• mongodb go driver Application denial of service via missing BSON array length validation in MongoDB Go Driver CVE-2026-107325 Fix available 8.2 HighOctober 8, 2026
• mongodb go driver Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver CVE-2026-107324 Fix available 8.2 HighOctober 8, 2026
• mongodb libmongocrypt Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt CVE-2026-106434 Fix available 5.3 MediumOctober 8, 2026
• mongodb libmongocrypt Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt CVE-2026-106433 Fix available 8.7 HighOctober 8, 2026
• mongodb libmongocrypt Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt CVE-2026-106429 Fix available 7.1 HighOctober 8, 2026
• mongodb c++ driver Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver CVE-2026-106430 Fix available 6.0 MediumOctober 8, 2026
• mongodb c driver Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver CVE-2026-106438 Fix available 5.1 MediumOctober 8, 2026
• Show olderLoading…