Mongodb Inc. vulnerabilities

Products

• Server 34
• C Driver 24
• Mongoid 8
• Php Driver 7
• C Driver 5
• Ops Manager 5
• Entity Framework Core Provider 3
• For Vs Code 2
• Go Driver 2

Newest

• mongodb c driver Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views CVE-2026-120954 6.3 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata CVE-2026-120955 Fix available 8.7 HighNovember 3, 2026
• mongodb c driver remote abort and memory disclosure from a malformed cursor.ns CVE-2026-120956 Fix available 7.1 HighNovember 3, 2026
• mongodb c driver MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password CVE-2026-120684 Fix available 6.0 MediumNovember 3, 2026
• mongodb c driver MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) CVE-2026-120678 Fix available 8.7 HighNovember 3, 2026
• mongodb c driver Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping CVE-2026-114645 Fix available 5.7 MediumOctober 22, 2026
• mongodb inc. php driver Unbounded Recursion in phongo_bson_visit_document/visit_array: CVE-2026-112368 Fix available 8.2 HighOctober 19, 2026
• mongodb php driver Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver CVE-2026-106436 Fix available 6.3 MediumOctober 8, 2026
• mongodb php driver Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver CVE-2026-106432 Fix available 2.0 LowOctober 8, 2026
• mongodb c driver Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver CVE-2026-106438 Fix available 5.1 MediumOctober 8, 2026
• mongodb c driver Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver CVE-2026-106437 Fix available 5.9 MediumOctober 8, 2026
• mongodb c driver One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver CVE-2026-106431 Fix available 5.9 MediumOctober 8, 2026
• mongodb c driver Out-of-bounds read in SCRAM response parsing in MongoDB C Driver CVE-2026-106428 Fix available 6.3 MediumOctober 8, 2026
• mongodb php driver PHP object injection via unsuppressible __pclass class inference in command monitoring events CVE-2026-96745 Fix available 6.3 MediumSeptember 24, 2026
• mongodb c driver Heap buffer overflow via mid-scan command list growth in client topology monitoring CVE-2026-96746 Fix available 8.3 HighSeptember 24, 2026
• mongodb mongoid Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist CVE-2026-93759 8.8 HighSeptember 18, 2026
• mongodb mongoid NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard CVE-2026-93760 8.3 HighSeptember 18, 2026
• mongodb mongoid Denial of service via unbounded regex matching in Mongoid's in-memory query matcher CVE-2026-93761 8.7 HighSeptember 18, 2026
• mongodb mongoid Data deletion and attribute disclosure via field-name method injection in in-memory queries CVE-2026-93762 9.2 CriticalSeptember 18, 2026
• mongodb mongoid Silent plaintext persistence via unresolved callable database name in encryption schema map CVE-2026-93763 7.1 HighSeptember 18, 2026
• mongodb mongoid Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation CVE-2026-93764 7.1 HighSeptember 18, 2026
• mongodb mongoid Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation CVE-2026-93765 8.3 HighSeptember 18, 2026
• mongodb mongoid Cross-principal document update, theft, and deletion via unvalidated id in nested attributes CVE-2026-93758 8.6 HighSeptember 18, 2026
• mongodb c driver Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVE-2026-93395 Fix available 6.9 MediumSeptember 17, 2026
• mongodb c driver libmongoc SCRAM client nonce-validation bypass CVE-2026-93394 Fix available 6.3 MediumSeptember 17, 2026
• mongodb c driver Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVE-2026-93393 Fix available 9.2 CriticalSeptember 17, 2026
• mongodb entity framework core provider Malformed connection string may disable field level encryption CVE-2026-92757 6.8 MediumSeptember 17, 2026
• mongodb entity framework core provider Logs may collect sensitive information CVE-2026-92758 5.7 MediumSeptember 17, 2026
• mongodb entity framework core provider Combining encryption settings may disable encryption CVE-2026-92756 6.8 MediumSeptember 17, 2026
• mongodb c driver GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver CVE-2026-88036 Fix available 6.1 MediumSeptember 10, 2026
• mongodb c driver Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver CVE-2026-88035 Fix available 5.7 MediumSeptember 10, 2026
• mongodb php driver Heap out-of-bounds read via corrupt nested BSON in field path error message CVE-2026-84968 Fix available 6.9 MediumSeptember 3, 2026
• mongodb, mongodb for vs code +1 more Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal CVE-2026-84967 Fix available 5.1 MediumSeptember 3, 2026
• mongodb c driver Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser CVE-2026-84963 Fix available 6.3 MediumSeptember 3, 2026
• mongodb c driver Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVE-2026-84964 Fix available 8.2 HighSeptember 3, 2026
• mongodb c driver Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds CVE-2026-84965 Fix available 5.9 MediumSeptember 3, 2026
• mongodb c driver Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output CVE-2026-84969 Fix available 6.3 MediumSeptember 3, 2026
• mongodb c driver Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver CVE-2026-81524 Fix available 5.3 MediumAugust 27, 2026
• mongodb c driver Heap memory out of bounds read and crash in C Driver legacy GridFS file reader CVE-2026-9100 Fix available 6.0 MediumMay 20, 2026
• mongodb php driver PHP Stack Exhaustion CVE-2026-6811 Fix available 6.0 MediumMay 14, 2026
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Post-auth null pointer dereference when aggregating against a view with empty search pipeline CVE-2026-8063 Fix available 7.1 HighMay 7, 2026
• mongodb c driver MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVE-2026-6691 Fix available 8.6 HighMay 6, 2026
• mongodb c driver bson_validate may skip validation when processing certain inputs CVE-2026-6231 Fix available 5.3 MediumApril 13, 2026
• mongodb c driver Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer CVE-2026-4359 Fix available 2.0 LowMarch 17, 2026
• mongodb inc go driver Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak CVE-2026-2303 Fix available 6.9 MediumFebruary 10, 2026
• mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 more Zlib compressed protocol header length confusion may allow memory read CVE-2025-14847 In KEVPublic exploitFix available EPSS 83.2% 8.7 HighDecember 19, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server CVE-2025-14345 Fix available 2.3 LowDecember 9, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more MongoDB may be susceptible to Invariant Failure due to batched delete CVE-2025-13644 Fix available 7.1 HighNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more MongoDB Server may allow queries to be terminated by unauthorized users CVE-2025-13643 Fix available 2.3 LowNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server CVE-2025-12893 Fix available 2.3 LowNovember 25, 2025
• Show olderLoading…