MI
Vendor
MongoDB, Inc.
48
CVEs
1
On KEV
4
New 30D
Products
CO6.8
Compass
MongoDB, Inc.
2 CVEs0 on KEV1 new
PD7.5
PHP Driver
MongoDB Inc.
2 CVEs0 on KEV1 new
MC4.3
Mongodb Controllers for Kubernetes
MongoDB, Inc.
1 CVEs0 on KEV1 new
MO6.8
mongosh
MongoDB, Inc.
1 CVEs0 on KEV1 new
MS8.8
MongoDB Server
MongoDB, Inc.
21 CVEs1 on KEV0 new
MO9.8
Mongoid
MongoDB Inc.
8 CVEs0 on KEV0 new
CD8.1
C Driver
MongoDB, Inc.
5 CVEs0 on KEV0 new
ME5.5
MongoDB Entity Framework Core Provider
MongoDB Inc.
3 CVEs0 on KEV0 new
MC7.8
MongoDB C Driver
MongoDB Inc.
2 CVEs0 on KEV0 new
MG6.5
MongoDB Go Driver
MongoDB Inc
1 CVEs0 on KEV0 new
MR6.5
MongoDB Ruby Driver
MongoDB Inc
1 CVEs0 on KEV0 new
OM7.2
Ops Manager
MongoDB, Inc.
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115930 New | MO mongosh MongoDB, Inc. | 6.8 | Oct 26 | MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-115929 New | CO Compass MongoDB, Inc. | 6.8 | Oct 24 | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-112368 | PD PHP Driver MongoDB Inc. | 7.5 | Oct 19 | Unbounded Recursion in phongo_bson_visit_document/visit_array: |
| CVE-2026-103546 | MC Mongodb Controllers for Kubernetes MongoDB, Inc. | 4.3 | Oct 5 | Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator |
| CVE-2026-93759 | MO Mongoid MongoDB Inc. | 8.6 | Sep 18 | Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist |
| CVE-2026-93760 | MO Mongoid MongoDB Inc. | 8.2 | Sep 18 | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard |
| CVE-2026-93761 | MO Mongoid MongoDB Inc. | 7.5 | Sep 18 | Denial of service via unbounded regex matching in Mongoid's in-memory query matcher |
| CVE-2026-93762 | MO Mongoid MongoDB Inc. | 9.8 | Sep 18 | Data deletion and attribute disclosure via field-name method injection in in-memory queries |
| CVE-2026-93763 | MO Mongoid MongoDB Inc. | 6.5 | Sep 18 | Silent plaintext persistence via unresolved callable database name in encryption schema map |
| CVE-2026-93764 | MO Mongoid MongoDB Inc. | 6.5 | Sep 18 | Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation |
| CVE-2026-93765 | MO Mongoid MongoDB Inc. | 9.1 | Sep 18 | Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation |
| CVE-2026-93758 | MO Mongoid MongoDB Inc. | 8.1 | Sep 18 | Cross-principal document update, theft, and deletion via unvalidated id in nested attributes |
| CVE-2026-93395 | CD C Driver MongoDB Inc. | 5.3 | Sep 17 | Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() |
| CVE-2026-93394 | CD C Driver MongoDB Inc. | 3.7 | Sep 17 | libmongoc SCRAM client nonce-validation bypass |
| CVE-2026-93393 | CD C Driver MongoDB Inc. | 8.1 | Sep 17 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream |
| CVE-2026-92757 | ME MongoDB Entity Framework Core Provider MongoDB Inc. | 5.5 | Sep 17 | Malformed connection string may disable field level encryption |
| CVE-2026-92758 | ME MongoDB Entity Framework Core Provider MongoDB Inc. | 5.5 | Sep 17 | Logs may collect sensitive information |
| CVE-2026-92756 | ME MongoDB Entity Framework Core Provider MongoDB Inc. | 5.5 | Sep 17 | Combining encryption settings may disable encryption |
| CVE-2026-9101 | CO Compass MongoDB, Inc. | 4.3 | May 20 | Prototype pollution in csv parsing |
| CVE-2026-9100 | CD C Driver MongoDB, Inc. | 7.1 | May 20 | Heap memory out of bounds read and crash in C Driver legacy GridFS file reader |
| CVE-2026-8843 | MS MongoDB Server MongoDB, Inc. | 6.5 | May 18 | Calling createIndex with certain index types can crash mongod |
| CVE-2026-6811 | PD PHP Driver MongoDB Inc. | 7.5 | May 14 | PHP Stack Exhaustion |
| CVE-2026-8202 | MS MongoDB Server MongoDB, Inc. | 6.5 | May 13 | Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators |
| CVE-2026-8336 | MS MongoDB Server MongoDB, Inc. | 6.5 | May 13 | Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands |
| CVE-2026-8201 | MS MongoDB Server MongoDB, Inc. | 8.8 | May 13 | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields |
| CVE-2026-8200 | MS MongoDB Server MongoDB, Inc. | 5.3 | May 13 | Schema validation log messages may not redact user data |
| CVE-2026-8199 | MS MongoDB Server MongoDB, Inc. | 6.5 | May 13 | Post-auth memory exhaustion via bitwise match expressions |
| CVE-2026-8053 | MS MongoDB Server MongoDB, Inc. | 8.8 | May 12 | FlatBSON Duplicate Field Index Drift |
| CVE-2026-8431 | OM Ops Manager MongoDB, Inc. | 7.2 | May 12 | Ops Manager RCE via webhook body |
| CVE-2026-8063 | MS MongoDB Server MongoDB Inc. | 6.5 | May 7 | Post-auth null pointer dereference when aggregating against a view with empty search pipeline |
| CVE-2026-6691 | MC MongoDB C Driver MongoDB Inc. | 7.8 | May 6 | MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow |
| CVE-2026-6231 | CD C Driver MongoDB Inc. | 7.5 | Apr 13 | bson_validate may skip validation when processing certain inputs |
| CVE-2026-4359 | MC MongoDB C Driver MongoDB Inc | 3.7 | Mar 17 | Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer |
| CVE-2026-4358 | MS MongoDB Server MongoDB Inc | 7.5 | Mar 17 | Memory safety issues in slot-based execution hash table spill |
| CVE-2026-4148 | MS MongoDB Server MongoDB Inc | 8.8 | Mar 17 | ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators |
| CVE-2026-4147 | MS MongoDB Server MongoDB Inc | 4.3 | Mar 17 | Stack memory disclosure in filemd5 command |
| CVE-2026-2303 | MG MongoDB Go Driver MongoDB Inc | 6.5 | Feb 10 | Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak |
| CVE-2026-2302 | MR MongoDB Ruby Driver MongoDB Inc | 6.5 | Feb 10 | Unsafe Reflection in Mongoid::Criteria.from_hash |
| CVE-2026-25613 | MS MongoDB Server MongoDB Inc | 6.5 | Feb 10 | An unsafe cast in the MongoDB query planner can result in a segmentation fault. |
| CVE-2026-1849 | MS MongoDB Server MongoDB Inc | 7.5 | Feb 10 | Mongod can run out of stack memory when expressions create deeply nested documents |
| CVE-2026-1850 | MS MongoDB Server MongoDB Inc | 7.5 | Feb 10 | An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification |
| CVE-2026-25609 | MS MongoDB Server MongoDB Inc | 4.3 | Feb 10 | profile command may permit unauthorized configuration |
| CVE-2026-25610 | MS MongoDB Server MongoDB Inc | 6.5 | Feb 10 | Invalid $geoNear index hint may cause server crash |
| CVE-2026-1848 | MS MongoDB Server MongoDB Inc | 7.5 | Feb 10 | Connections received from the proxy port may not count towards total accepted connections |
| CVE-2026-1847 | MS MongoDB Server MongoDB Inc | 7.5 | Feb 10 | MongoDB Server may crash when inserting large documents |
| CVE-2026-25612 | MS MongoDB Server MongoDB Inc | 6.5 | Feb 10 | Internal ResourceId collision may affect unrelated collections |
| CVE-2026-25611 | MS MongoDB Server MongoDB Inc | 7.5 | Feb 10 | Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server |
| CVE-2025-14847 In wildKEV | MS MongoDB Server MongoDB Inc. | 7.5 | Dec 19 | Zlib compressed protocol header length confusion may allow memory read |