# cve.now: MongoDB

The newest entries affecting MongoDB (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104005](https://cve.now/CVE-2026-104005.md): Incorrect authorization in MongoDB Server router for bulk writes to system namespaces (CVSS 7.1, MongoDB Server)
- [CVE-2026-104004](https://cve.now/CVE-2026-104004.md): Collection validators using collation-accepting expressions can crash MongoDB Server on insert (CVSS 7.1, MongoDB Server)
- [CVE-2026-103965](https://cve.now/CVE-2026-103965.md): Fixed values in MongoDB Server $bucket stage may be misread as field references (CVSS 5.3, MongoDB Server)
- [CVE-2026-96299](https://cve.now/CVE-2026-96299.md): Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-96297](https://cve.now/CVE-2026-96297.md): MongoDB Server may disclose process memory via a crafted \`$\_internalApplyOplogUpdate\` aggregation pipeline (CVSS 6.0, MongoDB Server)
- [CVE-2026-89099](https://cve.now/CVE-2026-89099.md): Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (CVSS 7.7, MongoDB Server)
- [CVE-2026-82076](https://cve.now/CVE-2026-82076.md): Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server (CVSS 7.1, MongoDB Server)
- [CVE-2026-82075](https://cve.now/CVE-2026-82075.md): Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service (CVSS 8.7, MongoDB Server)
- [CVE-2026-82074](https://cve.now/CVE-2026-82074.md): Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data (CVSS 7.1, MongoDB Server)
- [CVE-2026-82073](https://cve.now/CVE-2026-82073.md): Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search (CVSS 7.1, MongoDB Server)
- [CVE-2026-82071](https://cve.now/CVE-2026-82071.md): Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write (CVSS 7.2, MongoDB Server)
- [CVE-2026-82070](https://cve.now/CVE-2026-82070.md): Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface (CVSS 7.1, MongoDB Server)
- [CVE-2026-82069](https://cve.now/CVE-2026-82069.md): Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router (CVSS 5.1, MongoDB Server)
- [CVE-2026-82068](https://cve.now/CVE-2026-82068.md): Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-82067](https://cve.now/CVE-2026-82067.md): Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup (CVSS 9.2, MongoDB Server)
- [CVE-2026-82066](https://cve.now/CVE-2026-82066.md): Heap Out-of-Bounds Read in MongoDB Server Query Planning Component (CVSS 5.3, MongoDB Server)
- [CVE-2026-82065](https://cve.now/CVE-2026-82065.md): Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata (CVSS 7.1, MongoDB Server)
- [CVE-2026-82064](https://cve.now/CVE-2026-82064.md): Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members (CVSS 8.7, MongoDB Server)
- [CVE-2026-82063](https://cve.now/CVE-2026-82063.md): Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-82062](https://cve.now/CVE-2026-82062.md): Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass (CVSS 7.0, MongoDB Server)
- [CVE-2026-82061](https://cve.now/CVE-2026-82061.md): Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service (CVSS 7.2, MongoDB Server)
- [CVE-2026-82060](https://cve.now/CVE-2026-82060.md): Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups (CVSS 2.3, MongoDB Server)
- [CVE-2026-82059](https://cve.now/CVE-2026-82059.md): Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-82058](https://cve.now/CVE-2026-82058.md): Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-82057](https://cve.now/CVE-2026-82057.md): Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-82056](https://cve.now/CVE-2026-82056.md): Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-82055](https://cve.now/CVE-2026-82055.md): Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-82054](https://cve.now/CVE-2026-82054.md): Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-82053](https://cve.now/CVE-2026-82053.md): Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment (CVSS 7.6, MongoDB Server)
- [CVE-2026-82052](https://cve.now/CVE-2026-82052.md): $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars (CVSS 7.1, MongoDB Server)
- [CVE-2026-18712](https://cve.now/CVE-2026-18712.md): Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections (CVSS 7.2, MongoDB Server)
- [CVE-2026-18711](https://cve.now/CVE-2026-18711.md): Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-18709](https://cve.now/CVE-2026-18709.md): Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency (CVSS 5.9, MongoDB Server)
- [CVE-2026-18698](https://cve.now/CVE-2026-18698.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command (CVSS 5.3, MongoDB Server)
- [CVE-2026-18690](https://cve.now/CVE-2026-18690.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections (CVSS 7.2, MongoDB Server)
- [CVE-2026-18699](https://cve.now/CVE-2026-18699.md): Improper Input Validation in MongoDB Query Planner Leads to Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-18691](https://cve.now/CVE-2026-18691.md): Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure (CVSS 9.0, MongoDB Server)
- [CVE-2026-18702](https://cve.now/CVE-2026-18702.md): Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings (CVSS 5.3, MongoDB Server)
- [CVE-2026-18694](https://cve.now/CVE-2026-18694.md): Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-18708](https://cve.now/CVE-2026-18708.md): Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes (CVSS 5.3, MongoDB Server)
- [CVE-2026-18696](https://cve.now/CVE-2026-18696.md): Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections (CVSS 7.0, MongoDB Server)
- [CVE-2026-18700](https://cve.now/CVE-2026-18700.md): Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-18701](https://cve.now/CVE-2026-18701.md): Type Confusion in MongoDB Query Subsystem Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-18697](https://cve.now/CVE-2026-18697.md): Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos (CVSS 8.7, MongoDB Server)
- [CVE-2026-18693](https://cve.now/CVE-2026-18693.md): Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.2, MongoDB Server)
- [CVE-2026-18705](https://cve.now/CVE-2026-18705.md): Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data (CVSS 7.1, MongoDB Server)
- [CVE-2026-18704](https://cve.now/CVE-2026-18704.md): Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations (CVSS 7.1, MongoDB Server)
- [CVE-2026-18692](https://cve.now/CVE-2026-18692.md): Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution (CVSS 7.7, MongoDB Server)
- [CVE-2026-18688](https://cve.now/CVE-2026-18688.md): Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-18695](https://cve.now/CVE-2026-18695.md): Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-18687](https://cve.now/CVE-2026-18687.md): Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption (CVSS 7.1, MongoDB Server)
- [CVE-2026-18706](https://cve.now/CVE-2026-18706.md): Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution (CVSS 7.5, MongoDB Server)
- [CVE-2026-18707](https://cve.now/CVE-2026-18707.md): Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service (CVSS 5.3, MongoDB Server)
- [CVE-2026-18703](https://cve.now/CVE-2026-18703.md): Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method (CVSS 2.3, MongoDB Server)
- [CVE-2026-13055](https://cve.now/CVE-2026-13055.md): Server crash via aggregation pipeline expression with compound wildcard index specification (CVSS 7.1, MongoDB Server)
- [CVE-2026-13056](https://cve.now/CVE-2026-13056.md): A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM (CVSS 7.1, MongoDB Server)
- [CVE-2026-13057](https://cve.now/CVE-2026-13057.md): Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH\_META (CVSS 6.0, MongoDB Server)
- [CVE-2026-13058](https://cve.now/CVE-2026-13058.md): Transaction Command Insufficient Input Validation Leading to Process Termination (CVSS 7.1, MongoDB Server)
- [CVE-2026-13059](https://cve.now/CVE-2026-13059.md): Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass (CVSS 8.6, MongoDB Server)
- [CVE-2026-9737](https://cve.now/CVE-2026-9737.md): Find command with $meta sort can lead to crash (CVSS 7.1, MongoDB Server)
- [CVE-2026-13060](https://cve.now/CVE-2026-13060.md): $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access (CVSS 7.1, MongoDB Server)
- [CVE-2026-13061](https://cve.now/CVE-2026-13061.md): Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage (CVSS 5.3, MongoDB Server)
- [CVE-2026-13062](https://cve.now/CVE-2026-13062.md): MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters (CVSS 7.1, MongoDB Server)
- [CVE-2026-13063](https://cve.now/CVE-2026-13063.md): libmongocrypt Improper Input Validation Leading to Process Termination (CVSS 5.3, MongoDB Server)
- [CVE-2026-13064](https://cve.now/CVE-2026-13064.md): MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-13065](https://cve.now/CVE-2026-13065.md): MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination (CVSS 7.1, MongoDB Server)
- [CVE-2026-13066](https://cve.now/CVE-2026-13066.md): Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-13067](https://cve.now/CVE-2026-13067.md): tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket (CVSS 7.2, MongoDB Server)
- [CVE-2026-13068](https://cve.now/CVE-2026-13068.md): MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse (CVSS 2.3, MongoDB Server)
- [CVE-2026-13069](https://cve.now/CVE-2026-13069.md): Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion (CVSS 7.1, MongoDB Server)
- [CVE-2026-13070](https://cve.now/CVE-2026-13070.md): Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination (CVSS 6.0, MongoDB Server)
- [CVE-2026-13071](https://cve.now/CVE-2026-13071.md): Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination (CVSS 7.1, MongoDB Server)
- [CVE-2026-13072](https://cve.now/CVE-2026-13072.md): MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption (CVSS 9.2, MongoDB Server)
- [CVE-2026-13073](https://cve.now/CVE-2026-13073.md): MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination (CVSS 5.3, MongoDB Server)
- [CVE-2026-13074](https://cve.now/CVE-2026-13074.md): Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service (CVSS 6.9, MongoDB Server)
- [CVE-2026-13075](https://cve.now/CVE-2026-13075.md): $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation (CVSS 7.1, MongoDB Server)
- [CVE-2026-13076](https://cve.now/CVE-2026-13076.md): Aggregation Framework Memory Exhaustion Leading to Process Termination (CVSS 7.1, MongoDB Server)
- [CVE-2026-13077](https://cve.now/CVE-2026-13077.md): Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data (CVSS 7.1, MongoDB Server)
- [CVE-2026-13078](https://cve.now/CVE-2026-13078.md): Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader (CVSS 6.3, MongoDB Server)
- [CVE-2026-11933](https://cve.now/CVE-2026-11933.md): Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion (CVSS 8.8, MongoDB)
- [CVE-2026-9740](https://cve.now/CVE-2026-9740.md): Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow (CVSS 8.7, MongoDB Server)
- [CVE-2026-9735](https://cve.now/CVE-2026-9735.md): Keyfile contents are in MongoDB Server logs (CVSS 6.8, MongoDB Server)
- [CVE-2026-9754](https://cve.now/CVE-2026-9754.md): Stack memory disclosure in filemd5 command (CVSS 7.1, MongoDB)
- [CVE-2026-9753](https://cve.now/CVE-2026-9753.md): Server crash via malformed binary diff passed to $\_internalApplyOplogUpdate. (CVSS 7.2, MongoDB Server)
- [CVE-2026-9752](https://cve.now/CVE-2026-9752.md): GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation (CVSS 7.1, MongoDB Server)
- [CVE-2026-9751](https://cve.now/CVE-2026-9751.md): Sensitive data could be written to mongod.log (CVSS 6.8, MongoDB Server)
- [CVE-2026-9750](https://cve.now/CVE-2026-9750.md): Metadata name collision on $-prefixed fields causes post-auth server crash (CVSS 7.1, MongoDB Server)
- [CVE-2026-9749](https://cve.now/CVE-2026-9749.md): Using MaxKey() may crash the server (CVSS 7.1, MongoDB Server)
- [CVE-2026-9748](https://cve.now/CVE-2026-9748.md): $\_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input (CVSS 7.1, MongoDB Server)
- [CVE-2026-9747](https://cve.now/CVE-2026-9747.md): Crafted cross-shard merge aggregation crashes MongoDB Server (CVSS 7.1, MongoDB Server)
- [CVE-2026-9746](https://cve.now/CVE-2026-9746.md): Server crashes in case of the use of exchange (CVSS 7.1, MongoDB Server)
- [CVE-2026-9743](https://cve.now/CVE-2026-9743.md): Aggregation sub-pipeline null dereference may allow DoS via crafted getMore (CVSS 7.1, MongoDB server)
- [CVE-2026-9742](https://cve.now/CVE-2026-9742.md): Authenticate command with specific mechanism parameter can trigger server crash (CVSS 8.2, MongoDB Server)
- [CVE-2026-9741](https://cve.now/CVE-2026-9741.md): Client side encryption fails to encrypt values in a $vectorSearch (CVSS 7.1, MongoDB Server)
- [CVE-2026-8843](https://cve.now/CVE-2026-8843.md): Calling createIndex with certain index types can crash mongod (CVSS 7.1, MongoDB Server)
- [CVE-2026-8202](https://cve.now/CVE-2026-8202.md): Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators (CVSS 5.3, MongoDB Server)
- [CVE-2026-8336](https://cve.now/CVE-2026-8336.md): Post-authentication use-after-free error in $\_internalJsEmit and mapreduce commands (CVSS 7.7, MongoDB Server)
- [CVE-2026-8201](https://cve.now/CVE-2026-8201.md): Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields (CVSS 6.1, MongoDB Server)
- [CVE-2026-8200](https://cve.now/CVE-2026-8200.md): Schema validation log messages may not redact user data (CVSS 4.8, MongoDB Server)
- [CVE-2026-8199](https://cve.now/CVE-2026-8199.md): Post-auth memory exhaustion via bitwise match expressions (CVSS 7.1, MongoDB Server)
- [CVE-2026-8053](https://cve.now/CVE-2026-8053.md): FlatBSON Duplicate Field Index Drift (CVSS 8.7, MongoDB Server)
- [CVE-2026-8063](https://cve.now/CVE-2026-8063.md): Post-auth null pointer dereference when aggregating against a view with empty search pipeline (CVSS 7.1, MongoDB Server)
- [CVE-2026-6915](https://cve.now/CVE-2026-6915.md): Flaw in the updateUser Command May Allow Unauthorized Configuration Change (CVSS 5.3, MongoDB Server)
- [CVE-2026-6914](https://cve.now/CVE-2026-6914.md): MD5 checksum creation may cause availability loss (CVSS 7.1, MongoDB Server)
- [CVE-2026-5170](https://cve.now/CVE-2026-5170.md): Users could trigger a crash of mongod primaries during promotion to sharded (CVSS 6.0, MongoDB Server)
- [CVE-2026-4358](https://cve.now/CVE-2026-4358.md): Memory safety issues in slot-based execution hash table spill (CVSS 6.1, MongoDB Server)
- [CVE-2026-4148](https://cve.now/CVE-2026-4148.md): ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators (CVSS 8.7, MongoDB Server)
- [CVE-2026-4147](https://cve.now/CVE-2026-4147.md): Stack memory disclosure in filemd5 command (CVSS 7.1, MongoDB Server)
- [CVE-2026-25613](https://cve.now/CVE-2026-25613.md): An unsafe cast in the MongoDB query planner can result in a segmentation fault. (CVSS 7.1, MongoDB Server)
- [CVE-2026-1849](https://cve.now/CVE-2026-1849.md): Mongod can run out of stack memory when expressions create deeply nested documents (CVSS 7.1, MongoDB Server)
- [CVE-2026-1850](https://cve.now/CVE-2026-1850.md): An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification (CVSS 7.1, MongoDB Server)
- [CVE-2026-25609](https://cve.now/CVE-2026-25609.md): profile command may permit unauthorized configuration (CVSS 5.3, MongoDB Server)
- [CVE-2026-25610](https://cve.now/CVE-2026-25610.md): Invalid $geoNear index hint may cause server crash (CVSS 7.1, MongoDB Server)
- [CVE-2026-1848](https://cve.now/CVE-2026-1848.md): Connections received from the proxy port may not count towards total accepted connections (CVSS 8.2, MongoDB Server)
- [CVE-2026-1847](https://cve.now/CVE-2026-1847.md): MongoDB Server may crash when inserting large documents (CVSS 7.1, MongoDB Server)
- [CVE-2026-25612](https://cve.now/CVE-2026-25612.md): Internal ResourceId collision may affect unrelated collections (CVSS 7.1, MongoDB Server)
- [CVE-2026-25611](https://cve.now/CVE-2026-25611.md): Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server (CVSS 8.7, MongoDB Server)
- [CVE-2025-14847](https://cve.now/CVE-2025-14847.md): Zlib compressed protocol header length confusion may allow memory read (CVSS 8.7, KEV, MongoDB Server)
- [CVE-2025-14345](https://cve.now/CVE-2025-14345.md): Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server (CVSS 4.2, MongoDB Server)
- [CVE-2025-13644](https://cve.now/CVE-2025-13644.md): MongoDB may be susceptible to Invariant Failure due to batched delete (CVSS 6.5, MongoDB Server)
- [CVE-2025-13643](https://cve.now/CVE-2025-13643.md): MongoDB Server may allow queries to be terminated by unauthorized users (CVSS 3.1, MongoDB Server)
- [CVE-2025-12893](https://cve.now/CVE-2025-12893.md): Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server (CVSS 4.2, MongoDB Server)
- [CVE-2025-13507](https://cve.now/CVE-2025-13507.md): Time-series operations may cause internal BSON size limit to be exceed (CVSS 7.1, MongoDB Server)
- [CVE-2025-12657](https://cve.now/CVE-2025-12657.md): Malformed KMIP response may result in access violation (CVSS 5.9, MongoDB Server)
- [CVE-2025-10491](https://cve.now/CVE-2025-10491.md): MongoDB Windows installation MSI may leave ACLs unset on custom installation directories (CVSS 7.8, MongoDB Server)
- [CVE-2025-10061](https://cve.now/CVE-2025-10061.md): Malformed $group Query May Cause MongoDB Server to Crash (CVSS 6.5, MongoDB Server)
- [CVE-2025-10060](https://cve.now/CVE-2025-10060.md): MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation (CVSS 6.5, MongoDB Server)
- [CVE-2025-10059](https://cve.now/CVE-2025-10059.md): MongoDB Server router will crash when incorrect lsid is set on a sharded query (CVSS 6.5, MongoDB Server)
- [CVE-2025-7259](https://cve.now/CVE-2025-7259.md): Certain Queries with Duplicate \_id Fields May Cause MongoDB Server to Crash (CVSS 6.5, MongoDB Server)
- [CVE-2025-6714](https://cve.now/CVE-2025-6714.md): Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections (CVSS 7.5, MongoDB Server)
- [CVE-2025-6713](https://cve.now/CVE-2025-6713.md): MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage (CVSS 7.7, MongoDB Server)
- [CVE-2025-6712](https://cve.now/CVE-2025-6712.md): MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation (CVSS 6.5, MongoDB Server)
- [CVE-2025-6711](https://cve.now/CVE-2025-6711.md): Incomplete Redaction of Sensitive Information in MongoDB Server Logs (CVSS 4.4, MongoDB Server)
- [CVE-2025-6710](https://cve.now/CVE-2025-6710.md): Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB (CVSS 7.5, MongoDB Server)
- [CVE-2025-6709](https://cve.now/CVE-2025-6709.md): Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication (CVSS 7.5, MongoDB Server)
- [CVE-2025-6707](https://cve.now/CVE-2025-6707.md): Race condition in privilege cache invalidation cycle (CVSS 4.2, MongoDB Server)
- [CVE-2025-6706](https://cve.now/CVE-2025-6706.md): Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server (CVSS 5.0, MongoDB Server)
- [CVE-2025-3085](https://cve.now/CVE-2025-3085.md): MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked (CVSS 8.1, MongoDB Server)
- [CVE-2025-3084](https://cve.now/CVE-2025-3084.md): MongoDB Server may crash due to improper validation of explain command (CVSS 6.5, MongoDB Server)
- [CVE-2025-3083](https://cve.now/CVE-2025-3083.md): Malformed MongoDB wire protocol messages may cause mongos to crash (CVSS 7.5, MongoDB Server)
- [CVE-2025-3082](https://cve.now/CVE-2025-3082.md): User may override a view's collation and gain unauthorized access to underlying data (CVSS 3.1, MongoDB Server)
- [CVE-2025-0755](https://cve.now/CVE-2025-0755.md): MongoDB C Driver bson library may be susceptible to buffer overflow (CVSS 8.4, MongoDB libbson · MongoDB Server)
- [CVE-2024-10921](https://cve.now/CVE-2024-10921.md): Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server (CVSS 6.8, MongoDB Server)
- [CVE-2024-8305](https://cve.now/CVE-2024-8305.md): MongoDB Server secondaries may crash due to forced index constraints (CVSS 6.5, MongoDB Server)
- [CVE-2024-8654](https://cve.now/CVE-2024-8654.md): MongoDB Server may access non-initialized region of memory leading to unexpected behaviour (CVSS 5.0, MongoDB Server)
- [CVE-2024-8207](https://cve.now/CVE-2024-8207.md): MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths (CVSS 6.4, MongoDB Server)
- [CVE-2024-6384](https://cve.now/CVE-2024-6384.md): Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (CVSS 5.3, MongoDB Server)
- [CVE-2024-7553](https://cve.now/CVE-2024-7553.md): Accessing Untrusted Directory May Allow Local Privilege Escalation (CVSS 7.3, MongoDB Server · MongoDB C Driver +1)
- [CVE-2024-6375](https://cve.now/CVE-2024-6375.md): Missing authorization check may lead to shard key refinement (CVSS 5.4, MongoDB Server)
- [CVE-2024-3374](https://cve.now/CVE-2024-3374.md): MongoDB Server (mongod) may crash when generating ftdc (CVSS 5.3, MongoDB Server)
- [CVE-2024-3372](https://cve.now/CVE-2024-3372.md): MongoDB Server may have unexpected application behaviour due to invalid BSON (CVSS 7.5, MongoDB Server)
- [CVE-2024-1351](https://cve.now/CVE-2024-1351.md): MongoDB Server may allow successful untrusted connection (CVSS 8.8, MongoDB Server)
- [CVE-2023-1409](https://cve.now/CVE-2023-1409.md): Certificate validation issue in MongoDB Server running on Windows or macOS (CVSS 5.3, MongoDB Server)
- [CVE-2022-24272](https://cve.now/CVE-2022-24272.md): MongoDB Server (mongod) may crash in response to unexpected requests (CVSS 6.5, MongoDB Server)
- [CVE-2021-32040](https://cve.now/CVE-2021-32040.md): Large aggregation pipelines with a specific stage can crash mongod under default configuration (CVSS 6.5, MongoDB Server)
- [CVE-2021-32036](https://cve.now/CVE-2021-32036.md): Denial of Service and Data Integrity vulnerability in features command (CVSS 5.4, MongoDB Server)
- [CVE-2021-20330](https://cve.now/CVE-2021-20330.md): Specific replication command with malformed oplog entries can crash secondaries (CVSS 6.5, MongoDB Server)
- [CVE-2021-32037](https://cve.now/CVE-2021-32037.md): User may trigger invariant when allowed to send commands directly to shards (CVSS 6.5, MongoDB Server)
- [CVE-2021-20333](https://cve.now/CVE-2021-20333.md): Server log entry spoofing via newline injection (CVSS 5.3, MongoDB Server)
- [CVE-2021-20326](https://cve.now/CVE-2021-20326.md): Specially crafted query may result in a denial of service of mongod (CVSS 6.5, MongoDB Server)
- [CVE-2018-25004](https://cve.now/CVE-2018-25004.md): Invariant failure when explaining a find with a UUID (CVSS 4.9, MongoDB Server)
- [CVE-2020-7929](https://cve.now/CVE-2020-7929.md): Specially crafted regex query can cause DoS (CVSS 6.5, MongoDB Server)
- [CVE-2019-20925](https://cve.now/CVE-2019-20925.md): Denial of service via malformed network packet (CVSS 7.5, MongoDB Server)
- [CVE-2018-20803](https://cve.now/CVE-2018-20803.md): Infinite loop in aggregation expression (CVSS 6.5, MongoDB Server)
- [CVE-2020-7928](https://cve.now/CVE-2020-7928.md): Improper neutralization of null byte leads to read overrun (CVSS 6.5, MongoDB Server)
- [CVE-2019-2393](https://cve.now/CVE-2019-2393.md): Crash while joining collections with $lookup (CVSS 6.5, MongoDB Server)
- [CVE-2019-20923](https://cve.now/CVE-2019-20923.md): Crash while handling internal Javascript exception types (CVSS 6.5, MongoDB Server)
- [CVE-2019-20924](https://cve.now/CVE-2019-20924.md): Invariant in IndexBoundsBuilder (CVSS 6.5, MongoDB Server)
- [CVE-2019-2392](https://cve.now/CVE-2019-2392.md): $mod can result in undefined behavior (CVSS 6.5, MongoDB Server)
- [CVE-2018-20805](https://cve.now/CVE-2018-20805.md): Invariant with $elemMatch (CVSS 6.5, MongoDB Server)
- [CVE-2018-20802](https://cve.now/CVE-2018-20802.md): Post-auth queries on compound index may crash mongod (CVSS 6.5, MongoDB Server)
- [CVE-2018-20804](https://cve.now/CVE-2018-20804.md): Invariant failure in applyOps (CVSS 6.5, MongoDB Server)
- [CVE-2020-7926](https://cve.now/CVE-2020-7926.md): Specific query can cause a DoS against MongoDB Server (CVSS 6.5, MongoDB Server)
- [CVE-2020-7925](https://cve.now/CVE-2020-7925.md): Denial of Service when processing malformed Role names (CVSS 7.5, MongoDB Server)
- [CVE-2020-7923](https://cve.now/CVE-2020-7923.md): Specific GeoQuery can cause DoS against MongoDB Server (CVSS 6.5, MongoDB Server)
- [CVE-2020-7921](https://cve.now/CVE-2020-7921.md): Administrative action may disable enforcement of per-user IP whitelisting (CVSS 4.6, MongoDB Server)
- [CVE-2019-2389](https://cve.now/CVE-2019-2389.md): Process termination via PID file manipulation (CVSS 5.3, MongoDB Server)
- [CVE-2019-2390](https://cve.now/CVE-2019-2390.md): Code execution on Windows via OpenSSL engine injection (CVSS 8.2, MongoDB Server)
- [CVE-2019-2386](https://cve.now/CVE-2019-2386.md): Authorization session conflation (CVSS 7.1, MongoDB Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/mongodb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.