Skip to contentMongodb, Inc. vulnerabilities
Newest
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege MisuseCVE-2026-13068Fix available2.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionCVE-2026-13069Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationCVE-2026-13070Fix available6.0 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationCVE-2026-13071Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionCVE-2026-13072Fix available9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationCVE-2026-13073Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceCVE-2026-13074Fix available6.9 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationCVE-2026-13075Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation Framework Memory Exhaustion Leading to Process TerminationCVE-2026-13076Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreOut-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataCVE-2026-13077Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderCVE-2026-13078Public exploitFix available6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowCVE-2026-9740Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreKeyfile contents are in MongoDB Server logsCVE-2026-9735Fix available6.8 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.CVE-2026-9753Fix available7.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationCVE-2026-9752Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreSensitive data could be written to mongod.logCVE-2026-9751Fix available6.8 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMetadata name collision on $-prefixed fields causes post-auth server crashCVE-2026-9750Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreUsing MaxKey() may crash the serverCVE-2026-9749Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputCVE-2026-9748Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreCrafted cross-shard merge aggregation crashes MongoDB ServerCVE-2026-9747Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crashes in case of the use of exchangeCVE-2026-9746Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation sub-pipeline null dereference may allow DoS via crafted getMoreCVE-2026-9743Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthenticate command with specific mechanism parameter can trigger server crashCVE-2026-9742Fix available8.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreClient side encryption fails to encrypt values in a $vectorSearchCVE-2026-9741Fix available7.1 High
- hcl software compassPrototype pollution in csv parsingCVE-2026-91015.3 Medium
- mongodb c driverHeap memory out of bounds read and crash in C Driver legacy GridFS file readerCVE-2026-9100Fix available6.0 Medium
- mongodb, mongodb, inc. mongodb server +1 moreCalling createIndex with certain index types can crash mongodCVE-2026-8843Fix available7.1 High
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsCVE-2026-8202Fix available5.3 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication use-after-free error in $_internalJsEmit and mapreduce commandsCVE-2026-8336Fix available7.7 High
- mongodb, mongodb, inc. mongodb server +1 moreUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsCVE-2026-8201Fix available6.1 Medium
- mongodb, mongodb, inc. mongodb server +1 moreSchema validation log messages may not redact user dataCVE-2026-8200Fix available4.8 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-auth memory exhaustion via bitwise match expressionsCVE-2026-8199Fix available7.1 High
- mongodb, mongodb, inc. mongodb server +1 moreFlatBSON Duplicate Field Index DriftCVE-2026-8053Fix available8.7 High
- mongodb ops managerOps Manager RCE via webhook bodyCVE-2026-84319.4 Critical
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 morePost-auth null pointer dereference when aggregating against a view with empty search pipelineCVE-2026-8063Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeCVE-2026-6915Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMD5 checksum creation may cause availability lossCVE-2026-6914Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUsers could trigger a crash of mongod primaries during promotion to shardedCVE-2026-5170Fix available6.0 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMemory safety issues in slot-based execution hash table spillCVE-2026-4358Fix available6.1 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operatorsCVE-2026-4148Fix available8.7 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreStack memory disclosure in filemd5 commandCVE-2026-4147Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreAn unsafe cast in the MongoDB query planner can result in a segmentation fault.CVE-2026-25613Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongod can run out of stack memory when expressions create deeply nested documentsCVE-2026-1849Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreAn authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplificationCVE-2026-1850Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreprofile command may permit unauthorized configurationCVE-2026-25609Fix available5.3 Medium
- mongodb inc server, mongodb, mongodb, inc. mongodb server +2 moreInvalid $geoNear index hint may cause server crashCVE-2026-25610Fix available7.1 High
- mongodb inc server, mongodb, mongodb, inc. mongodb server +2 moreConnections received from the proxy port may not count towards total accepted connectionsCVE-2026-1848Fix available8.2 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB Server may crash when inserting large documentsCVE-2026-1847Fix available7.1 High
- mongodb inc server, mongodb, inc. mongodb server +1 moreInternal ResourceId collision may affect unrelated collectionsCVE-2026-256127.1 High
- mongodb inc server, mongodb, inc. mongodb server +1 morePre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerCVE-2026-256118.7 High
- Show moreLoading…