Skip to contentMongodb, Inc. vulnerabilities
Newest
- mongodb server, mongodb, inc. mongodb server +1 moreUse-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulatorCVE-2026-1208195.3 Medium
- mongodb server, mongodb, inc. mongodb server +1 morePre-authentication use-after-free in MongoDB Server replica set primary catch-upCVE-2026-118383Public exploit9.5 Critical
- mongodb server, mongodb, inc. mongodb server +1 moreMemory exhaustion via abandoned far-future read-concern waiters in disaggregated storageCVE-2026-1208288.7 High
- mongodb server, mongodb, inc. mongodb server +1 moreImproper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized AccessCVE-2026-1208267.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreImproper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection AccessCVE-2026-1208257.1 High
- mongodb server, mongodb, inc. mongodb server +1 morePost-authentication use-after-free in MongoDB Server time-series bucket validationCVE-2026-1208248.7 High
- mongodb server, mongodb, inc. mongodb server +1 moreMissing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration DataCVE-2026-1208232.3 Low
- mongodb server, mongodb, inc. mongodb server +1 moreMissing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data AccessCVE-2026-1208228.6 High
- mongodb server, mongodb, inc. mongodb server +1 morePost-authentication use-after-free in MongoDB Server aggregation sub-pipelinesCVE-2026-1208217.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreUncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of ServiceCVE-2026-1208205.3 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreUse-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information DisclosureCVE-2026-1208187.1 High
- mongodb server, mongodb, inc. mongodb server +1 morePost-authentication race condition in MongoDB Server geospatial schema validationCVE-2026-1208177.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreSystem collection contents readable through a database change stream with showSystemEventsCVE-2026-1208162.3 Low
- mongodb server, mongodb, inc. mongodb server +1 moreIncorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative AccessCVE-2026-1208158.6 High
- mongodb server, mongodb, inc. mongodb server +1 moreMultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root userCVE-2026-1208147.5 High
- mongodb server, mongodb, inc. mongodb server +1 morePlaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsingCVE-2026-1208138.2 High
- mongodb server, mongodb, inc. mongodb server +1 moreFull server crash via unbounded per-operand recursion in time-series query vectorizationCVE-2026-1208126.0 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreUse-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of ServiceCVE-2026-1208116.0 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreUncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of ServiceCVE-2026-1208107.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreHeap use-after-free read via yield-time state save in time-series block unpackingCVE-2026-1208096.1 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreCertificate Validation Bypass via IPv6 trust-result skip in macOS TLS clientCVE-2026-1208089.1 Critical
- mongodb server, mongodb, inc. mongodb server +1 morePrivilege escalation via fail-open user lookup in X.509 cluster-membership guardCVE-2026-1208077.5 High
- mongodb server, mongodb, inc. mongodb server +1 moreAuthorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabaseCVE-2026-1208067.0 High
- mongodb server, mongodb, inc. mongodb server +1 moreAuthorization bypass via redirected FLE2 state-collection writes in encrypted CRUD pathCVE-2026-1208052.3 Low
- mongodb server, mongodb, inc. mongodb server +1 moreCredential-handle retention via missing flag set in Windows Kerberos auth handlerCVE-2026-1208048.2 High
- mongodb server, mongodb, inc. mongodb server +1 moreMongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server CrashCVE-2026-1208037.1 High
- mongodb inc mongoshMongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAsCVE-2026-1159307.6 High
- hcl software compassMongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAsCVE-2026-1159297.6 High
- mongodb server, mongodb, inc. mongodb server +1 moreIncorrect authorization in MongoDB Server router for bulk writes to system namespacesCVE-2026-1040057.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreCollection validators using collation-accepting expressions can crash MongoDB Server on insertCVE-2026-1040047.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreFixed values in MongoDB Server $bucket stage may be misread as field referencesCVE-2026-1039655.3 Medium
- mongodb server, mongodb, inc. mongodb server +1 moreMissing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of ServiceCVE-2026-962997.1 High
- mongodb server, mongodb, inc. mongodb server +1 moreMongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipelineCVE-2026-962976.0 Medium
- mongodb ops managerOps Manager Sensitive MFA Enrollment Information Exposure in User ListingsCVE-2026-871096.0 Medium
- mongodb ops managerOps Manager Improper Authorization in Daily Host Monitoring RetrievalCVE-2026-871082.3 Low
- mongodb ops managerOps Manager Uncontrolled Resource Consumption in Monitoring EndpointsCVE-2026-871106.9 Medium
- mongodb, inc. mongodb controllers for kubernetesImproper validation of Ops Manager configuration in MongoDB Kubernetes OperatorCVE-2026-1035462.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreRace Condition in MongoDB Server Document Value Layer Leads to Memory CorruptionCVE-2026-89099Fix available7.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInteger Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB ServerCVE-2026-82076Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServiceCVE-2026-82075Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreIncorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection DataCVE-2026-82074Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas SearchCVE-2026-82073Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds WriteCVE-2026-82071Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficiently Protected Credentials in MongoDB Server Diagnostic Reporting InterfaceCVE-2026-82070Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster RouterCVE-2026-82069Fix available5.1 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morePersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceCVE-2026-82068Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupCVE-2026-82067Fix available9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreHeap Out-of-Bounds Read in MongoDB Server Query Planning ComponentCVE-2026-82066Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataCVE-2026-82065Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUnauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersCVE-2026-82064Fix available8.7 High
- Show olderLoading…