MO
Vendor
MongoDB
423
CVEs
2
On KEV
46
New 30D
Products
MO9.9
MongoDB
Database
287 CVEs2 on KEV35 new
OM7.2
Ops Manager
Mongodb
7 CVEs0 on KEV3 new
CD8.3
C Driver
Mongodb
33 CVEs0 on KEV2 new
PD8.2
Php Driver
Mongodb
8 CVEs0 on KEV2 new
GD8.1
GO Driver
Mongodb
5 CVEs0 on KEV2 new
LI8.8
Libmongocrypt
Mongodb
4 CVEs0 on KEV1 new
PD8.3
Python Driver
Mongodb
2 CVEs0 on KEV1 new
BC8.0
BI Connector
Mongodb
8 CVEs0 on KEV0 new
MO9.8
Mongoid
Mongodb
8 CVEs0 on KEV0 new
BC9.8
BI Connector Odbc Driver
Mongodb
7 CVEs0 on KEV0 new
CO9.8
Compass
Mongodb
6 CVEs0 on KEV0 new
RD8.3
Rust Driver
Mongodb
5 CVEs0 on KEV0 new
JD8.3
Java Driver
Mongodb
4 CVEs0 on KEV0 new
MO8.8
Mongosh
Mongodb
4 CVEs0 on KEV0 new
EF5.5
Entity Framework Core Provider
Mongodb
3 CVEs0 on KEV0 new
LM8.1
Laravel Mongodb
Mongodb
3 CVEs0 on KEV0 new
LI8.1
Libbson
Mongodb
3 CVEs0 on KEV0 new
MT6.3
Mongosql Transition Readiness Tool
Mongodb
3 CVEs0 on KEV0 new
BS9.8
Bson
Mongodb
2 CVEs0 on KEV0 new
JS7.5
Js-bson
Mongodb
2 CVEs0 on KEV0 new
OM7.2
Ops Manager Server
Mongodb
2 CVEs0 on KEV0 new
PL8.3
Php Library
Mongodb
2 CVEs0 on KEV0 new
SS6.5
Sql Schema Builder Cli
Mongodb
2 CVEs0 on KEV0 new
AK7.5
Atlas Kubernetes Operator
Mongodb
1 CVEs0 on KEV0 new
C7.5
C++
Mongodb
1 CVEs0 on KEV0 new
DT6.5
Database Tools
Mongodb
1 CVEs0 on KEV0 new
MC3.3
Mongo Crypt V1.so
Mongodb
1 CVEs0 on KEV0 new
MO3.3
Mongocryptd
Mongodb
1 CVEs0 on KEV0 new
MC6.8
Mongodb Client Encryption
Mongodb
1 CVEs0 on KEV0 new
ME6.5
Mongodb Enterprise Kubernetes Operator
Mongodb
1 CVEs0 on KEV0 new
MO6.5
Mongomirror
Mongodb
1 CVEs0 on KEV0 new
NO7.5
Node.js
Mongodb
1 CVEs0 on KEV0 new
OD6.5
Odbc Driver
Mongodb
1 CVEs0 on KEV0 new
PY8.1
Pymongo
Mongodb
1 CVEs0 on KEV0 new
RD8.3
Ruby Driver
Mongodb
1 CVEs0 on KEV0 new
SD7.5
Swift Driver
Mongodb
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114655 New | MO MongoDB MongoDB | 5.9 | Oct 22 | KMS request injection via unsanitized key vault and provider values in libmongocrypt |
| CVE-2026-114654 New | MO MongoDB MongoDB | 6.5 | Oct 22 | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-114653 New | MO MongoDB MongoDB | 6.5 | Oct 22 | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder |
| CVE-2026-114652 New | MO MongoDB MongoDB | 6.5 | Oct 22 | Update operator injection via single-element list rewriting in the update builder |
| CVE-2026-114651 New | MO MongoDB MongoDB | 4.0 | Oct 22 | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
| CVE-2026-114650 New | MO MongoDB MongoDB | 5.9 | Oct 22 | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-114649 New | MO MongoDB MongoDB | 6.8 | Oct 22 | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache |
| CVE-2026-114648 New | MO MongoDB MongoDB | 7.6 | Oct 22 | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys |
| CVE-2026-114647 New | MO MongoDB MongoDB | 4.3 | Oct 22 | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-114646 New | MO MongoDB MongoDB | 6.5 | Oct 22 | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-114645 New | MO MongoDB MongoDB | 5.2 | Oct 22 | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping |
| CVE-2026-114644 New | MO MongoDB MongoDB | 5.9 | Oct 22 | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization |
| CVE-2026-114643 New | MO MongoDB MongoDB | 5.4 | Oct 22 | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-113870 New | MO MongoDB MongoDB | 8.8 | Oct 21 | Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing |
| CVE-2026-104005 | MO MongoDB MongoDB | 6.5 | Oct 13 | Incorrect authorization in MongoDB Server router for bulk writes to system namespaces |
| CVE-2026-104004 | MO MongoDB MongoDB | 6.5 | Oct 13 | Collection validators using collation-accepting expressions can crash MongoDB Server on insert |
| CVE-2026-103965 | MO MongoDB MongoDB | 5.4 | Oct 13 | Fixed values in MongoDB Server $bucket stage may be misread as field references |
| CVE-2026-96299 | MO MongoDB MongoDB | 6.5 | Oct 13 | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service |
| CVE-2026-96297 | MO MongoDB MongoDB | 6.5 | Oct 13 | MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline |
| CVE-2026-87109 | MO MongoDB MongoDB | 6.5 | Oct 9 | Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings |
| CVE-2026-87108 | MO MongoDB MongoDB | 4.3 | Oct 9 | Ops Manager Improper Authorization in Daily Host Monitoring Retrieval |
| CVE-2026-87110 | MO MongoDB MongoDB | 5.3 | Oct 9 | Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints |
| CVE-2026-106435 | MO MongoDB MongoDB | 4.7 | Oct 8 | Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver |
| CVE-2026-106436 | MO MongoDB MongoDB | 6.5 | Oct 8 | Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver |
| CVE-2026-106432 | MO MongoDB MongoDB | 8.2 | Oct 8 | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver |
| CVE-2026-107325 | MO MongoDB MongoDB | 5.9 | Oct 8 | Application denial of service via missing BSON array length validation in MongoDB Go Driver |
| CVE-2026-107324 | MO MongoDB MongoDB | 5.9 | Oct 8 | Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver |
| CVE-2026-106434 | MO MongoDB MongoDB | 4.3 | Oct 8 | Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt |
| CVE-2026-106433 | MO MongoDB MongoDB | 8.8 | Oct 8 | Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt |
| CVE-2026-106429 | MO MongoDB MongoDB | 6.5 | Oct 8 | Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt |
| CVE-2026-106430 | MO MongoDB MongoDB | 5.9 | Oct 8 | Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver |
| CVE-2026-106438 | MO MongoDB MongoDB | 3.7 | Oct 8 | Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver |
| CVE-2026-106437 | MO MongoDB MongoDB | 7.4 | Oct 8 | Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver |
| CVE-2026-106431 | MO MongoDB MongoDB | 5.7 | Oct 8 | One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver |
| CVE-2026-106428 | MO MongoDB MongoDB | 3.7 | Oct 8 | Out-of-bounds read in SCRAM response parsing in MongoDB C Driver |
| CVE-2026-96749 | MO MongoDB MongoDB | 8.4 | Sep 24 | Heap out-of-bounds write via signed size overflow in BSON document encoding |
| CVE-2026-96748 | MO MongoDB MongoDB | 6.5 | Sep 24 | Connection redirection via percent-encoded delimiter injection in connection string hosts |
| CVE-2026-96747 | MO MongoDB MongoDB | 5.0 | Sep 24 | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption |
| CVE-2026-96745 | MO MongoDB MongoDB | 5.6 | Sep 24 | PHP object injection via unsuppressible __pclass class inference in command monitoring events |
| CVE-2026-96746 | MO MongoDB MongoDB | 6.5 | Sep 24 | Heap buffer overflow via mid-scan command list growth in client topology monitoring |
| CVE-2026-96750 | MO MongoDB MongoDB | 7.1 | Sep 24 | Shell script injection via server-supplied database name in Open MongoDB shell |
| CVE-2026-96744 | MO MongoDB MongoDB | 7.1 | Sep 24 | Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel |
| CVE-2026-93759 | MO Mongoid Mongodb | 8.6 | Sep 18 | Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist |
| CVE-2026-93760 | MO Mongoid Mongodb | 8.2 | Sep 18 | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard |
| CVE-2026-93761 | MO Mongoid Mongodb | 7.5 | Sep 18 | Denial of service via unbounded regex matching in Mongoid's in-memory query matcher |
| CVE-2026-93762 | MO Mongoid Mongodb | 9.8 | Sep 18 | Data deletion and attribute disclosure via field-name method injection in in-memory queries |
| CVE-2026-93763 | MO Mongoid Mongodb | 6.5 | Sep 18 | Silent plaintext persistence via unresolved callable database name in encryption schema map |
| CVE-2026-93764 | MO Mongoid Mongodb | 6.5 | Sep 18 | Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation |
| CVE-2026-93765 | MO Mongoid Mongodb | 9.1 | Sep 18 | Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation |
| CVE-2026-93758 | MO Mongoid Mongodb | 8.1 | Sep 18 | Cross-principal document update, theft, and deletion via unvalidated id in nested attributes |
| CVE-2026-93395 | CD C Driver Mongodb | 5.3 | Sep 17 | Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() |
| CVE-2026-93394 | CD C Driver Mongodb | 3.7 | Sep 17 | libmongoc SCRAM client nonce-validation bypass |
| CVE-2026-93393 | CD C Driver Mongodb | 8.1 | Sep 17 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream |
| CVE-2026-92757 | EF Entity Framework Core Provider Mongodb | 5.5 | Sep 17 | Malformed connection string may disable field level encryption |
| CVE-2026-92758 | EF Entity Framework Core Provider Mongodb | 5.5 | Sep 17 | Logs may collect sensitive information |
| CVE-2026-92756 | EF Entity Framework Core Provider Mongodb | 5.5 | Sep 17 | Combining encryption settings may disable encryption |
| CVE-2026-89099 | MO MongoDB MongoDB | 7.5 | Sep 11 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption |
| CVE-2026-88036 | MO MongoDB MongoDB | 8.3 | Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver |
| CVE-2026-88035 | MO MongoDB MongoDB | 5.5 | Sep 10 | Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver |
| CVE-2026-88034 | MO MongoDB MongoDB | 8.3 | Sep 10 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver |