Latest vulnerabilities for "mongodb mongodb"

MongoDB MongoDBFind command with $meta sort can lead to crash

Risk 29

Severity

7.1

EPSS

0.24%

First published (updated )

CVE-2026-9737

MongoDB MongoDBMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13064

MongoDB MongoDBMongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13065

MongoDB MongoDBtlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

Risk 51

Severity

7.2

First published (updated )

CVE-2026-13067

MongoDB MongoDBMongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

Risk 26

Severity

5.3

First published (updated )

CVE-2026-13073

MongoDB MongoDBAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

Risk 33

Severity

6.9

First published (updated )

CVE-2026-13074

MongoDB MongoDBPost-authentication use-after-free in server-side JavaScript BSON-to-array conversion

Risk 79

Severity

8.7

First published (updated )

CVE-2026-11933

MongoDB MongoDBUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

Risk 33

Severity

8.7

EPSS

0.34%

First published (updated )

CVE-2026-9740

MongoDB MongoDB ServerKeyfile contents are in MongoDB Server logs

Risk 27

Severity

6.8

EPSS

0.12%

First published (updated )

CVE-2026-9735

MongoDB MongoDBStack memory disclosure in filemd5 command

Risk 29

Severity

7.1

EPSS

0.22%

First published (updated )

CVE-2026-9754

MongoDB MongoDBServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Risk 43

Severity

7.2

EPSS

0.30%

First published (updated )

CVE-2026-9753

MongoDB MongoDBGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9752

MongoDB MongoDBSensitive data could be written to mongod.log

Risk 27

Severity

6.8

EPSS

0.11%

First published (updated )

CVE-2026-9751

MongoDB MongoDBMetadata name collision on $-prefixed fields causes post-auth server crash

Risk 29

Severity

7.1

EPSS

0.37%

First published (updated )

CVE-2026-9750

MongoDB MongoDBUsing MaxKey() may crash the server

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9749

MongoDB MongoDB$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Risk 29

Severity

7.1

EPSS

0.32%

First published (updated )

CVE-2026-9748

MongoDB MongoDBCrafted cross-shard merge aggregation crashes MongoDB Server

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9747

MongoDB MongoDBServer crashes in case of the use of exchange

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9746

MongoDB MongoDB ServerAggregation sub-pipeline null dereference may allow DoS via crafted getMore

Risk 29

Severity

7.1

EPSS

0.31%

First published (updated )

CVE-2026-9743

MongoDB MongoDBAuthenticate command with specific mechanism parameter can trigger server crash

Risk 31

Severity

8.2

EPSS

0.35%

First published (updated )

CVE-2026-9742

MongoDB MongoDBClient side encryption fails to encrypt values in a $vectorSearch

Risk 29

Severity

7.1

EPSS

0.10%

First published (updated )

CVE-2026-9741

A week after Dutch FIOD seized 800+ servers, the hosting network's ASN (AS209847) is still scanning at its normal daily rate

First published (updated )

Social

MongoDB MongoDBPost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Risk 27

Severity

5.3

EPSS

0.05%

First published (updated )

CVE-2026-8202

MongoDB MongoDBPost-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Risk 51

Severity

7.7

EPSS

0.26%

First published (updated )

CVE-2026-8336

MongoDB MongoDBUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

Risk 56

Severity

6.1

EPSS

0.03%

First published (updated )

CVE-2026-8201

MongoDB MongoDBSchema validation log messages may not redact user data

Risk 19

Severity

4.8

EPSS

0.04%

First published (updated )

CVE-2026-8200

MongoDB MongoDBPost-auth memory exhaustion via bitwise match expressions

Risk 29

Severity

7.1

EPSS

0.05%

First published (updated )

CVE-2026-8199

MongoDB MongoDBFlatBSON Duplicate Field Index Drift

Risk 56

Severity

8.7

EPSS

0.07%

First published (updated )

CVE-2026-8053

MongoDB MongoDB ServerPost-auth null pointer dereference when aggregating against a view with empty search pipeline

Risk 29

Severity

7.1

EPSS

0.04%

First published (updated )

CVE-2026-8063

MongoDB MongoDBFlaw in the updateUser Command May Allow Unauthorized Configuration Change

Risk 33

Severity

5.3

EPSS

0.05%

First published (updated )

CVE-2026-6915

Trending

Versions

MongoDB MongoDBFind command with $meta sort can lead to crash

MongoDB MongoDBMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

MongoDB MongoDBMongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

MongoDB MongoDBtlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

MongoDB MongoDBMongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

Don't miss critical vulnerabilities

MongoDB MongoDBAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

MongoDB MongoDBPost-authentication use-after-free in server-side JavaScript BSON-to-array conversion

MongoDB MongoDBUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

MongoDB MongoDB ServerKeyfile contents are in MongoDB Server logs

MongoDB MongoDBStack memory disclosure in filemd5 command

Don't miss critical vulnerabilities

MongoDB MongoDBServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.

MongoDB MongoDBGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

MongoDB MongoDBSensitive data could be written to mongod.log

MongoDB MongoDBMetadata name collision on $-prefixed fields causes post-auth server crash

MongoDB MongoDBUsing MaxKey() may crash the server

Don't miss critical vulnerabilities

MongoDB MongoDB$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

MongoDB MongoDBCrafted cross-shard merge aggregation crashes MongoDB Server

MongoDB MongoDBServer crashes in case of the use of exchange

MongoDB MongoDB ServerAggregation sub-pipeline null dereference may allow DoS via crafted getMore

MongoDB MongoDBAuthenticate command with specific mechanism parameter can trigger server crash

Don't miss critical vulnerabilities

MongoDB MongoDBClient side encryption fails to encrypt values in a $vectorSearch

A week after Dutch FIOD seized 800+ servers, the hosting network's ASN (AS209847) is still scanning at its normal daily rate

MongoDB MongoDBPost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

MongoDB MongoDBPost-authentication use-after-free error in $_internalJsEmit and mapreduce commands

MongoDB MongoDBUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

Don't miss critical vulnerabilities

MongoDB MongoDBSchema validation log messages may not redact user data

MongoDB MongoDBPost-auth memory exhaustion via bitwise match expressions

MongoDB MongoDBFlatBSON Duplicate Field Index Drift

MongoDB MongoDB ServerPost-auth null pointer dereference when aggregating against a view with empty search pipeline

MongoDB MongoDBFlaw in the updateUser Command May Allow Unauthorized Configuration Change

Don't miss critical vulnerabilities

Company

Resources

Contact