Skip to contentMongodb vulnerabilities
Newest
- mongodb c driverOut-of-bounds read and write via undersized BSON buffer reservation in MongoDB C DriverCVE-2026-106437Fix available5.9 Medium
- mongodb c driverOne-byte heap buffer overflow in BSON bulk document writer in MongoDB C DriverCVE-2026-106431Fix available5.9 Medium
- mongodb c driverOut-of-bounds read in SCRAM response parsing in MongoDB C DriverCVE-2026-106428Fix available6.3 Medium
- mongodb python driverHeap out-of-bounds write via signed size overflow in BSON document encodingCVE-2026-96749Fix available7.5 High
- mongodb python driverConnection redirection via percent-encoded delimiter injection in connection string hostsCVE-2026-96748Fix available8.3 High
- mongodb python driverForced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionCVE-2026-96747Fix available5.3 Medium
- mongodb php driverPHP object injection via unsuppressible __pclass class inference in command monitoring eventsCVE-2026-96745Fix available6.3 Medium
- mongodb c driverHeap buffer overflow via mid-scan command list growth in client topology monitoringCVE-2026-96746Fix available8.3 High
- hcl software compassShell script injection via server-supplied database name in Open MongoDB shellCVE-2026-967507.3 High
- mongodb laravel mongodb (php)Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for LaravelCVE-2026-967447.1 High
- mongodb mongoidServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistCVE-2026-937598.8 High
- mongodb mongoidNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardCVE-2026-937608.3 High
- mongodb mongoidDenial of service via unbounded regex matching in Mongoid's in-memory query matcherCVE-2026-937618.7 High
- mongodb mongoidData deletion and attribute disclosure via field-name method injection in in-memory queriesCVE-2026-937629.2 Critical
- mongodb mongoidSilent plaintext persistence via unresolved callable database name in encryption schema mapCVE-2026-937637.1 High
- mongodb mongoidPlaintext storage of encrypted fields via skipped embedded models in encryption schema generationCVE-2026-937647.1 High
- mongodb mongoidDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationCVE-2026-937658.3 High
- mongodb mongoidCross-principal document update, theft, and deletion via unvalidated id in nested attributesCVE-2026-937588.6 High
- mongodb c driverInteger Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()CVE-2026-93395Fix available6.9 Medium
- mongodb c driverlibmongoc SCRAM client nonce-validation bypassCVE-2026-93394Fix available6.3 Medium
- mongodb c driverHeap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamCVE-2026-93393Fix available9.2 Critical
- mongodb entity framework core providerMalformed connection string may disable field level encryptionCVE-2026-927576.8 Medium
- mongodb entity framework core providerLogs may collect sensitive informationCVE-2026-927585.7 Medium
- mongodb entity framework core providerCombining encryption settings may disable encryptionCVE-2026-927566.8 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreRace Condition in MongoDB Server Document Value Layer Leads to Memory CorruptionCVE-2026-89099Fix available7.7 High
- mongodb c driverGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C DriverCVE-2026-88036Fix available6.1 Medium
- mongodb c driverHeap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C DriverCVE-2026-88035Fix available5.7 Medium
- mongodb c++ driver, c\+\+ driver +1 moreGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverCVE-2026-88034Fix available6.1 Medium
- mongodb java driverGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverCVE-2026-880336.1 Medium
- mongodb java driver, org.mongodb:mongodb-crypt maven package, org.mongodb:mongodb-driver-reactivestreams maven package +2 moreApplication denial of service via cancellation race in reactive client-side encryption in MongoDB Java DriverCVE-2026-880328.2 High
- mongodb go driverGridFS data deletion via query-operator injection in file IDs in the MongoDB Go DriverCVE-2026-880316.1 Medium
- mongodb ruby driverGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby DriverCVE-2026-88030Fix available6.1 Medium
- mongodb python driverGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python DriverCVE-2026-88029Fix available6.1 Medium
- mongodb laravel mongodb (php), laravel mongodb +1 moreUnauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for LaravelCVE-2026-880287.1 High
- mongodb laravel mongodb (php), laravel mongodb +1 moreMass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for LaravelCVE-2026-880277.1 High
- mongodb c# driver, c\# driver +1 moreRegular expression injection via unescaped characters in LINQ query translation in MongoDB C# DriverCVE-2026-880267.1 High
- mongodb c# driver, c\# driver +1 moreGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# DriverCVE-2026-880256.1 Medium
- mongodb rust driverGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust DriverCVE-2026-880246.1 Medium
- mongodb php libraryGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP LibraryCVE-2026-88023Fix available6.1 Medium
- mongodb laravel mongodb (php), laravel mongodb +1 moreUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelCVE-2026-880228.4 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInteger Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB ServerCVE-2026-82076Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServiceCVE-2026-82075Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreIncorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection DataCVE-2026-82074Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas SearchCVE-2026-82073Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds WriteCVE-2026-82071Fix available7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreInsufficiently Protected Credentials in MongoDB Server Diagnostic Reporting InterfaceCVE-2026-82070Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster RouterCVE-2026-82069Fix available5.1 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morePersistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceCVE-2026-82068Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupCVE-2026-82067Fix available9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreHeap Out-of-Bounds Read in MongoDB Server Query Planning ComponentCVE-2026-82066Fix available5.3 Medium
- Show moreLoading…