Skip to contentMongodb vulnerabilities
Newest
- mongodb bi connector odbc driverMongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object namesCVE-2026-190019.5 Critical
- mongodb bi connector odbc driverCrafted database metadata may cause memory corruption in MongoDB BI Connector ODBC DriverCVE-2026-190028.8 High
- mongodb atlas sql odbc driver, odbc driver, schema builder cli +1 more +3 moreInsufficient OIDC endpoint validation could invoke unintended local protocol handlersCVE-2026-195036.3 Medium
- mongodb schema builder cli, sql schema builder cli +1 moreInsufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLICVE-2026-195026.8 Medium
- mongodb driver, java driver +1 moreCleartext Storage of Sensitive Information in MongoDB Driver Logging During Client InitializationCVE-2026-187108.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other CollectionsCVE-2026-18712Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUse-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory DisclosureCVE-2026-18711Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMissing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data InconsistencyCVE-2026-18709Fix available5.9 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate CommandCVE-2026-18698Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Server Allows Unauthorized Actions on System CollectionsCVE-2026-18690Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Input Validation in MongoDB Query Planner Leads to Denial of ServiceCVE-2026-18699Fix available6.0 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authentication in MongoDB Intra-Cluster Connections Allows Credential ExposureCVE-2026-18691Fix available9.0 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic SettingsCVE-2026-18702Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreOut-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory DisclosureCVE-2026-18694Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query ScopesCVE-2026-18708Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on CollectionsCVE-2026-18696Fix available7.0 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUse-After-Free in MongoDB Geospatial Validation Leads to Denial of ServiceCVE-2026-18700Fix available6.0 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreType Confusion in MongoDB Query Subsystem Leads to Denial of ServiceCVE-2026-18701Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongosCVE-2026-18697Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreOut-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory DisclosureCVE-2026-18693Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View DataCVE-2026-18705Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write OperationsCVE-2026-18704Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUse-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code ExecutionCVE-2026-18692Fix available7.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreOut-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory DisclosureCVE-2026-18688Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceCVE-2026-18695Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index CorruptionCVE-2026-18687Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUse-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code ExecutionCVE-2026-18706Fix available7.5 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of ServiceCVE-2026-18707Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication MethodCVE-2026-18703Fix available2.3 Low
- mongodb compassCompass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flowCVE-2026-148818.4 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer crash via aggregation pipeline expression with compound wildcard index specificationCVE-2026-13055Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMCVE-2026-13056Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_METACVE-2026-13057Fix available6.0 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreTransaction Command Insufficient Input Validation Leading to Process TerminationCVE-2026-13058Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassCVE-2026-13059Fix available8.6 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFind command with $meta sort can lead to crashCVE-2026-9737Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection AccessCVE-2026-13060Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation StageCVE-2026-13061Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersCVE-2026-13062Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morelibmongocrypt Improper Input Validation Leading to Process TerminationCVE-2026-13063Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceCVE-2026-13064Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $linearFill Window Function Improper Input Validation Leading to Process TerminationCVE-2026-13065Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer-Side JavaScript DBPointer BSON Serialization Memory DisclosureCVE-2026-13066Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moretlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain SocketCVE-2026-13067Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege MisuseCVE-2026-13068Fix available2.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionCVE-2026-13069Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationCVE-2026-13070Fix available6.0 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationCVE-2026-13071Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionCVE-2026-13072Fix available9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationCVE-2026-13073Fix available5.3 Medium
- Show moreLoading…