Skip to contentMongodb Server vulnerabilities
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index CorruptionCVE-2026-18687Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUse-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code ExecutionCVE-2026-18706Fix available7.5 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of ServiceCVE-2026-18707Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication MethodCVE-2026-18703Fix available2.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer crash via aggregation pipeline expression with compound wildcard index specificationCVE-2026-13055Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMCVE-2026-13056Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_METACVE-2026-13057Fix available6.0 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreTransaction Command Insufficient Input Validation Leading to Process TerminationCVE-2026-13058Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassCVE-2026-13059Fix available8.6 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFind command with $meta sort can lead to crashCVE-2026-9737Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection AccessCVE-2026-13060Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation StageCVE-2026-13061Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersCVE-2026-13062Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morelibmongocrypt Improper Input Validation Leading to Process TerminationCVE-2026-13063Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceCVE-2026-13064Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $linearFill Window Function Improper Input Validation Leading to Process TerminationCVE-2026-13065Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer-Side JavaScript DBPointer BSON Serialization Memory DisclosureCVE-2026-13066Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moretlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain SocketCVE-2026-13067Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege MisuseCVE-2026-13068Fix available2.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionCVE-2026-13069Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationCVE-2026-13070Fix available6.0 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationCVE-2026-13071Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionCVE-2026-13072Fix available9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationCVE-2026-13073Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceCVE-2026-13074Fix available6.9 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationCVE-2026-13075Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation Framework Memory Exhaustion Leading to Process TerminationCVE-2026-13076Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreOut-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataCVE-2026-13077Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderCVE-2026-13078Public exploitFix available6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowCVE-2026-9740Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreKeyfile contents are in MongoDB Server logsCVE-2026-9735Fix available6.8 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.CVE-2026-9753Fix available7.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationCVE-2026-9752Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreSensitive data could be written to mongod.logCVE-2026-9751Fix available6.8 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMetadata name collision on $-prefixed fields causes post-auth server crashCVE-2026-9750Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreUsing MaxKey() may crash the serverCVE-2026-9749Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputCVE-2026-9748Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreCrafted cross-shard merge aggregation crashes MongoDB ServerCVE-2026-9747Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crashes in case of the use of exchangeCVE-2026-9746Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation sub-pipeline null dereference may allow DoS via crafted getMoreCVE-2026-9743Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthenticate command with specific mechanism parameter can trigger server crashCVE-2026-9742Fix available8.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreClient side encryption fails to encrypt values in a $vectorSearchCVE-2026-9741Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeCVE-2026-6915Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMD5 checksum creation may cause availability lossCVE-2026-6914Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUsers could trigger a crash of mongod primaries during promotion to shardedCVE-2026-5170Fix available6.0 Medium
- mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 moreZlib compressed protocol header length confusion may allow memory readCVE-2025-14847In KEVPublic exploitFix availableEPSS 83.2%8.7 High