MS
Product
MongoDB Server
On CISA KEVExploited in the wild
12
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 7Low 0
Watch
Add MongoDB Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14847 In wildKEV | 7.5 | Dec 19 | Zlib compressed protocol header length confusion may allow memory read Affected: 8.2 before 8.2.3; 8.0 before 8.0.17; 7.0 before 7.0.28; 6.0 before 6.0.27; 5.0 before 5.0.32; 4.4 before 4.4.30; +3 more |
| CVE-2026-8201 | 8.8 | May 13 | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields Affected: 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-8053 | 8.8 | May 12 | FlatBSON Duplicate Field Index Drift Affected: 5.0 before 5.0.33; 6.0 before 6.0.28; 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-4148 | 8.8 | Mar 17 | ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators Affected: 8.2 before 8.2.6; 8.0 before 8.0.20; 7.0 before 7.0.31 |
| CVE-2026-4358 | 7.5 | Mar 17 | Memory safety issues in slot-based execution hash table spill Affected: 8.2 before 8.2.6; 8.0 before 8.0.20; 7.0 before 7.0.31 |
| CVE-2026-8843 | 6.5 | May 18 | Calling createIndex with certain index types can crash mongod Affected: 7.0 before 7.0.32; 8.0 before 8.0.21; 8.2 before 8.2.6 |
| CVE-2026-8202 | 6.5 | May 13 | Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators Affected: 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-8336 | 6.5 | May 13 | Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands Affected: 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-8199 | 6.5 | May 13 | Post-auth memory exhaustion via bitwise match expressions Affected: 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-8063 | 6.5 | May 7 | Post-auth null pointer dereference when aggregating against a view with empty search pipeline Affected: 8.2.0 before 8.2.7 |
| CVE-2026-8200 | 5.3 | May 13 | Schema validation log messages may not redact user data Affected: 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-4147 | 4.3 | Mar 17 | Stack memory disclosure in filemd5 command Affected: 8.2 before 8.2.6; 8.0 before 8.0.20; 7.0 before 7.0.31 |
Showing 12