[ Vendor · 46 CVEs ]
MongoDB
CVEs affecting MongoDB published in the last 30 days, plus any MongoDB CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114655 | 22 Oct 2026 | CVSS 5.9 | MongoDB libmongocryptlibmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider… | |
| CVE-2026-114651 | 22 Oct 2026 | CVSS 4.0 | MongoDB C# DriverA memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content… | |
| CVE-2026-114652 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied… | |
| CVE-2026-114653 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is… | |
| CVE-2026-114654 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through… | |
| CVE-2026-114644 | 22 Oct 2026 | CVSS 5.9 | MongoDB C# DriverThe MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type… | |
| CVE-2026-114645 | 22 Oct 2026 | CVSS 5.2 | MongoDB C DriverA 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be… | |
| CVE-2026-114646 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or… | |
| CVE-2026-114647 | 22 Oct 2026 | CVSS 4.3 | MongoDB C# DriverThe MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other… | |
| CVE-2026-114648 | 22 Oct 2026 | CVSS 7.6 | MongoDB C# DriverThe MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries… | |
| CVE-2026-114649 | 22 Oct 2026 | CVSS 6.8 | MongoDB C# DriverThe MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached… | |
| CVE-2026-114650 | 22 Oct 2026 | CVSS 5.9 | MongoDB C# DriverA flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be… | |
| CVE-2026-114643 | 22 Oct 2026 | CVSS 5.4 | MongoDB C# DriverThe MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and… | |
| CVE-2026-113870 | 21 Oct 2026 | CVSS 8.8 | MongoDB CompassMongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user… | |
| CVE-2026-96297 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerUse of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released… | Fix |
| CVE-2026-96299 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerA security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the… | Fix |
| CVE-2026-104005 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerA security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the… | Fix |
| CVE-2026-103965 | 13 Oct 2026 | CVSS 5.4 | MongoDB ServerAn issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under… | Fix |
| CVE-2026-104004 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerMongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the… | Fix |
| CVE-2026-87109 | 9 Oct 2026 | CVSS 6.5 | MongoDB Ops ManagerAn authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints… | |
| CVE-2026-87110 | 9 Oct 2026 | CVSS 5.3 | MongoDB Ops ManagerAn unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without… | |
| CVE-2026-87108 | 9 Oct 2026 | CVSS 4.3 | MongoDB Ops ManagerAn authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when… | |
| CVE-2026-106435 | 8 Oct 2026 | CVSS 4.7 | MongoDB Python DriverThe MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated… | |
| CVE-2026-106436 | 8 Oct 2026 | CVSS 6.5 | MongoDB PHP DriverThe BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the… | |
| CVE-2026-106432 | 8 Oct 2026 | CVSS 8.2 | MongoDB PHP DriverThe BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a… | |
| CVE-2026-107324 | 8 Oct 2026 | CVSS 5.9 | MongoDB Go DriverAn integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a… | |
| CVE-2026-107325 | 8 Oct 2026 | CVSS 5.9 | MongoDB Go DriverImproper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls… | |
| CVE-2026-106431 | 8 Oct 2026 | CVSS 5.7 | MongoDB C DriverAn off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a… | |
| CVE-2026-106433 | 8 Oct 2026 | CVSS 8.8 | MongoDB libmongocryptImproper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key… | |
| CVE-2026-106434 | 8 Oct 2026 | CVSS 4.3 | MongoDB libmongocryptThe explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption… | |
| CVE-2026-106437 | 8 Oct 2026 | CVSS 6.2 | MongoDB C DriverThe BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison… | |
| CVE-2026-106438 | 8 Oct 2026 | CVSS 4.0 | MongoDB C DriverAn incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros… | |
| CVE-2026-106428 | 8 Oct 2026 | CVSS 3.7 | MongoDB C DriverAn out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a… | |
| CVE-2026-106429 | 8 Oct 2026 | CVSS 6.5 | MongoDB libmongocryptAn integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application… | |
| CVE-2026-106430 | 8 Oct 2026 | CVSS 5.9 | MongoDB C++ DriverThe MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can… | |
| CVE-2026-96747 | 24 Sep 2026 | CVSS 5.0 | PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryptionThe client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local… | Fix |
| CVE-2026-96748 | 24 Sep 2026 | CVSS 6.5 | PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimitersPyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When… | Fix |
| CVE-2026-96749 | 24 Sep 2026 | CVSS 8.4 | PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encodingAn integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document… | Fix |
| CVE-2026-96744 | 24 Sep 2026 | CVSS 7.1 | MongoDB Laravel MongoDB (PHP)Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a… | |
| CVE-2026-96745 | 24 Sep 2026 | CVSS 5.6 | MongoDB PHP DriverDeserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to… | Fix |
| CVE-2026-96746 | 24 Sep 2026 | CVSS 6.5 | MongoDB C DriverAn out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and… | Fix |
| CVE-2026-96750 | 24 Sep 2026 | CVSS 7.1 | MongoDB CompassMongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell… | |
| CVE-2026-88029 | 10 Sep 2026 | CVSS 8.3 | pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methodsImproper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied… | Fix |
| CVE-2026-88023 | 10 Sep 2026 | CVSS 8.3 | MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDsImproper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied… | Fix |
| CVE-2025-14847 | 19 Dec 2025 | CVSS 7.5 | MongoDB and MongoDB Server Improper Handling of Length Parameter InconsistencyMismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue… | ExploitedFix |
| CVE-2019-10758 | 24 Dec 2019 | CVSS 9.9 | MongoDB mongo-express Remote Code Executionmongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to… | Exploited |