# cve.now: MongoDB

The newest entries naming MongoDB as an affected vendor (up to 200), of 383 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120819](https://cve.now/CVE-2026-120819.md): Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator (CVSS 5.3)
- [CVE-2026-118383](https://cve.now/CVE-2026-118383.md): Pre-authentication use-after-free in MongoDB Server replica set primary catch-up (CVSS 9.5)
- [CVE-2026-120828](https://cve.now/CVE-2026-120828.md): Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage (CVSS 8.7)
- [CVE-2026-120826](https://cve.now/CVE-2026-120826.md): Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access (CVSS 7.1)
- [CVE-2026-120825](https://cve.now/CVE-2026-120825.md): Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access (CVSS 7.1)
- [CVE-2026-120824](https://cve.now/CVE-2026-120824.md): Post-authentication use-after-free in MongoDB Server time-series bucket validation (CVSS 8.7)
- [CVE-2026-120823](https://cve.now/CVE-2026-120823.md): Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data (CVSS 2.3)
- [CVE-2026-120822](https://cve.now/CVE-2026-120822.md): Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access (CVSS 8.6)
- [CVE-2026-120821](https://cve.now/CVE-2026-120821.md): Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines (CVSS 7.1)
- [CVE-2026-120820](https://cve.now/CVE-2026-120820.md): Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service (CVSS 5.3)
- [CVE-2026-120818](https://cve.now/CVE-2026-120818.md): Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure (CVSS 7.1)
- [CVE-2026-120817](https://cve.now/CVE-2026-120817.md): Post-authentication race condition in MongoDB Server geospatial schema validation (CVSS 7.1)
- [CVE-2026-120816](https://cve.now/CVE-2026-120816.md): System collection contents readable through a database change stream with showSystemEvents (CVSS 2.3)
- [CVE-2026-120815](https://cve.now/CVE-2026-120815.md): Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access (CVSS 8.6)
- [CVE-2026-120814](https://cve.now/CVE-2026-120814.md): MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user (CVSS 7.5)
- [CVE-2026-120813](https://cve.now/CVE-2026-120813.md): Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing (CVSS 8.2)
- [CVE-2026-120812](https://cve.now/CVE-2026-120812.md): Full server crash via unbounded per-operand recursion in time-series query vectorization (CVSS 6.0)
- [CVE-2026-120811](https://cve.now/CVE-2026-120811.md): Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service (CVSS 6.0)
- [CVE-2026-120810](https://cve.now/CVE-2026-120810.md): Uncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-120809](https://cve.now/CVE-2026-120809.md): Heap use-after-free read via yield-time state save in time-series block unpacking (CVSS 6.1)
- [CVE-2026-120808](https://cve.now/CVE-2026-120808.md): Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client (CVSS 9.1)
- [CVE-2026-120807](https://cve.now/CVE-2026-120807.md): Privilege escalation via fail-open user lookup in X.509 cluster-membership guard (CVSS 7.5)
- [CVE-2026-120806](https://cve.now/CVE-2026-120806.md): Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase (CVSS 7.0)
- [CVE-2026-120805](https://cve.now/CVE-2026-120805.md): Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path (CVSS 2.3)
- [CVE-2026-120804](https://cve.now/CVE-2026-120804.md): Credential-handle retention via missing flag set in Windows Kerberos auth handler (CVSS 8.2)
- [CVE-2026-120803](https://cve.now/CVE-2026-120803.md): MongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server Crash (CVSS 7.1)
- [CVE-2026-120959](https://cve.now/CVE-2026-120959.md): MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes (CVSS 2.1)
- [CVE-2026-120952](https://cve.now/CVE-2026-120952.md): MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL\_C\_GUID target, causing a 32-byte out-of-bounds write (CVSS 6.0)
- [CVE-2026-120567](https://cve.now/CVE-2026-120567.md): EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference (CVSS 2.3)
- [CVE-2026-120953](https://cve.now/CVE-2026-120953.md): Atlas SQL JDBC Driver \<=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler (CVSS 5.1)
- [CVE-2026-120954](https://cve.now/CVE-2026-120954.md): Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views (CVSS 6.3)
- [CVE-2026-120955](https://cve.now/CVE-2026-120955.md): MongoDB C Driver Modern GridFS mongoc\_gridfs\_bucket\_download\_to\_stream() Aborts Application on Malformed GridFS Metadata (CVSS 8.7)
- [CVE-2026-120956](https://cve.now/CVE-2026-120956.md): remote abort and memory disclosure from a malformed cursor.ns (CVSS 7.1)
- [CVE-2026-120684](https://cve.now/CVE-2026-120684.md): MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password (CVSS 6.0)
- [CVE-2026-120678](https://cve.now/CVE-2026-120678.md): MongoDB C Driver leaks the decompressed reply buffer when an OP\_COMPRESSED reply fails to parse (denial of service) (CVSS 8.7)
- [CVE-2026-120673](https://cve.now/CVE-2026-120673.md): Rust Driver 3.9.1 exports CSFLE plaintext in \`db.query.text\` before encrypting the command (CVSS 6.8)
- [CVE-2026-119674](https://cve.now/CVE-2026-119674.md): mongorestore may restore encoded collection names into an unintended collection (CVSS 2.1)
- [CVE-2026-119673](https://cve.now/CVE-2026-119673.md): mongofiles may write outside the working directory through a symlink (CVSS 1.0)
- [CVE-2026-119672](https://cve.now/CVE-2026-119672.md): mongofiles may disclose GridFS content to standard output through a stored filename (CVSS 5.9)
- [CVE-2026-119675](https://cve.now/CVE-2026-119675.md): mongorestore may bypass collection guards through a system.buckets prefix (CVSS 5.2)
- [CVE-2026-119179](https://cve.now/CVE-2026-119179.md): MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data (CVSS 8.3)
- [CVE-2026-116641](https://cve.now/CVE-2026-116641.md): The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs (CVSS 7.6)
- [CVE-2026-118581](https://cve.now/CVE-2026-118581.md): NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (CVSS 6.9)
- [CVE-2026-118510](https://cve.now/CVE-2026-118510.md): Laravel MongoDB \`whereDoesntHave\` misses deny records for numeric string IDs (CVSS 7.7)
- [CVE-2026-115930](https://cve.now/CVE-2026-115930.md): MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 7.6)
- [CVE-2026-115929](https://cve.now/CVE-2026-115929.md): MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 7.6)
- [CVE-2026-114655](https://cve.now/CVE-2026-114655.md): KMS request injection via unsanitized key vault and provider values in libmongocrypt (CVSS 6.0)
- [CVE-2026-114654](https://cve.now/CVE-2026-114654.md): BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards (CVSS 6.9)
- [CVE-2026-114653](https://cve.now/CVE-2026-114653.md): Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder (CVSS 7.1)
- [CVE-2026-114652](https://cve.now/CVE-2026-114652.md): Update operator injection via single-element list rewriting in the update builder (CVSS 7.1)
- [CVE-2026-114651](https://cve.now/CVE-2026-114651.md): Cross-document data leak via malformed BSON array parsing in reused thread buffer (CVSS 6.3)
- [CVE-2026-114650](https://cve.now/CVE-2026-114650.md): Plaintext exposure of encrypted fields via ANSI code-page corruption of database name (CVSS 6.9)
- [CVE-2026-114649](https://cve.now/CVE-2026-114649.md): Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache (CVSS 7.6)
- [CVE-2026-114648](https://cve.now/CVE-2026-114648.md): NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys (CVSS 7.2)
- [CVE-2026-114647](https://cve.now/CVE-2026-114647.md): NoSQL operator injection via unvalidated replacement document in findOneAndReplace (CVSS 5.3)
- [CVE-2026-114646](https://cve.now/CVE-2026-114646.md): NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire (CVSS 6.9)
- [CVE-2026-114645](https://cve.now/CVE-2026-114645.md): Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping (CVSS 5.7)
- [CVE-2026-114644](https://cve.now/CVE-2026-114644.md): Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization (CVSS 8.2)
- [CVE-2026-114643](https://cve.now/CVE-2026-114643.md): Duplicate geometry fields via unvalidated GeoJSON extra members (CVSS 5.3)
- [CVE-2026-113870](https://cve.now/CVE-2026-113870.md): Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing (CVSS 8.8)
- [CVE-2026-112368](https://cve.now/CVE-2026-112368.md): Unbounded Recursion in phongo\_bson\_visit\_document/visit\_array: (CVSS 8.2)
- [CVE-2026-104005](https://cve.now/CVE-2026-104005.md): Incorrect authorization in MongoDB Server router for bulk writes to system namespaces (CVSS 7.1)
- [CVE-2026-104004](https://cve.now/CVE-2026-104004.md): Collection validators using collation-accepting expressions can crash MongoDB Server on insert (CVSS 7.1)
- [CVE-2026-103965](https://cve.now/CVE-2026-103965.md): Fixed values in MongoDB Server $bucket stage may be misread as field references (CVSS 5.3)
- [CVE-2026-96299](https://cve.now/CVE-2026-96299.md): Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-96297](https://cve.now/CVE-2026-96297.md): MongoDB Server may disclose process memory via a crafted \`$\_internalApplyOplogUpdate\` aggregation pipeline (CVSS 6.0)
- [CVE-2026-87109](https://cve.now/CVE-2026-87109.md): Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings (CVSS 6.0)
- [CVE-2026-87108](https://cve.now/CVE-2026-87108.md): Ops Manager Improper Authorization in Daily Host Monitoring Retrieval (CVSS 2.3)
- [CVE-2026-87110](https://cve.now/CVE-2026-87110.md): Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints (CVSS 6.9)
- [CVE-2026-106435](https://cve.now/CVE-2026-106435.md): Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver (CVSS 5.9)
- [CVE-2026-106436](https://cve.now/CVE-2026-106436.md): Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver (CVSS 6.3)
- [CVE-2026-106432](https://cve.now/CVE-2026-106432.md): Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver (CVSS 2.0)
- [CVE-2026-107325](https://cve.now/CVE-2026-107325.md): Application denial of service via missing BSON array length validation in MongoDB Go Driver (CVSS 8.2)
- [CVE-2026-107324](https://cve.now/CVE-2026-107324.md): Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver (CVSS 8.2)
- [CVE-2026-106434](https://cve.now/CVE-2026-106434.md): Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt (CVSS 5.3)
- [CVE-2026-106433](https://cve.now/CVE-2026-106433.md): Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt (CVSS 8.7)
- [CVE-2026-106429](https://cve.now/CVE-2026-106429.md): Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt (CVSS 7.1)
- [CVE-2026-106430](https://cve.now/CVE-2026-106430.md): Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver (CVSS 6.0)
- [CVE-2026-106438](https://cve.now/CVE-2026-106438.md): Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver (CVSS 5.1)
- [CVE-2026-106437](https://cve.now/CVE-2026-106437.md): Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver (CVSS 5.9)
- [CVE-2026-106431](https://cve.now/CVE-2026-106431.md): One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver (CVSS 5.9)
- [CVE-2026-106428](https://cve.now/CVE-2026-106428.md): Out-of-bounds read in SCRAM response parsing in MongoDB C Driver (CVSS 6.3)
- [CVE-2026-103546](https://cve.now/CVE-2026-103546.md): Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator (CVSS 2.3)
- [CVE-2026-96749](https://cve.now/CVE-2026-96749.md): Heap out-of-bounds write via signed size overflow in BSON document encoding (CVSS 7.5)
- [CVE-2026-96748](https://cve.now/CVE-2026-96748.md): Connection redirection via percent-encoded delimiter injection in connection string hosts (CVSS 8.3)
- [CVE-2026-96747](https://cve.now/CVE-2026-96747.md): Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption (CVSS 5.3)
- [CVE-2026-96745](https://cve.now/CVE-2026-96745.md): PHP object injection via unsuppressible \_\_pclass class inference in command monitoring events (CVSS 6.3)
- [CVE-2026-96746](https://cve.now/CVE-2026-96746.md): Heap buffer overflow via mid-scan command list growth in client topology monitoring (CVSS 8.3)
- [CVE-2026-96750](https://cve.now/CVE-2026-96750.md): Shell script injection via server-supplied database name in Open MongoDB shell (CVSS 7.3)
- [CVE-2026-96744](https://cve.now/CVE-2026-96744.md): Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel (CVSS 7.1)
- [CVE-2026-93759](https://cve.now/CVE-2026-93759.md): Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (CVSS 8.8)
- [CVE-2026-93760](https://cve.now/CVE-2026-93760.md): NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (CVSS 8.3)
- [CVE-2026-93761](https://cve.now/CVE-2026-93761.md): Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (CVSS 8.7)
- [CVE-2026-93762](https://cve.now/CVE-2026-93762.md): Data deletion and attribute disclosure via field-name method injection in in-memory queries (CVSS 9.2)
- [CVE-2026-93763](https://cve.now/CVE-2026-93763.md): Silent plaintext persistence via unresolved callable database name in encryption schema map (CVSS 7.1)
- [CVE-2026-93764](https://cve.now/CVE-2026-93764.md): Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (CVSS 7.1)
- [CVE-2026-93765](https://cve.now/CVE-2026-93765.md): Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (CVSS 8.3)
- [CVE-2026-93758](https://cve.now/CVE-2026-93758.md): Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (CVSS 8.6)
- [CVE-2026-93395](https://cve.now/CVE-2026-93395.md): Integer Underflow → Heap Out-of-Bounds Read in \`bson\_new\_from\_buffer() (CVSS 6.9)
- [CVE-2026-93394](https://cve.now/CVE-2026-93394.md): libmongoc SCRAM client nonce-validation bypass (CVSS 6.3)
- [CVE-2026-93393](https://cve.now/CVE-2026-93393.md): Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (CVSS 9.2)
- [CVE-2026-92757](https://cve.now/CVE-2026-92757.md): Malformed connection string may disable field level encryption (CVSS 6.8)
- [CVE-2026-92758](https://cve.now/CVE-2026-92758.md): Logs may collect sensitive information (CVSS 5.7)
- [CVE-2026-92756](https://cve.now/CVE-2026-92756.md): Combining encryption settings may disable encryption (CVSS 6.8)
- [CVE-2026-89099](https://cve.now/CVE-2026-89099.md): Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (CVSS 7.7)
- [CVE-2026-88036](https://cve.now/CVE-2026-88036.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (CVSS 6.1)
- [CVE-2026-88035](https://cve.now/CVE-2026-88035.md): Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (CVSS 5.7)
- [CVE-2026-88034](https://cve.now/CVE-2026-88034.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver (CVSS 6.1)
- [CVE-2026-88033](https://cve.now/CVE-2026-88033.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (CVSS 6.1)
- [CVE-2026-88032](https://cve.now/CVE-2026-88032.md): Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (CVSS 8.2)
- [CVE-2026-88031](https://cve.now/CVE-2026-88031.md): GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver (CVSS 6.1)
- [CVE-2026-88030](https://cve.now/CVE-2026-88030.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver (CVSS 6.1)
- [CVE-2026-88029](https://cve.now/CVE-2026-88029.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver (CVSS 6.1)
- [CVE-2026-88028](https://cve.now/CVE-2026-88028.md): Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel (CVSS 7.1)
- [CVE-2026-88027](https://cve.now/CVE-2026-88027.md): Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel (CVSS 7.1)
- [CVE-2026-88026](https://cve.now/CVE-2026-88026.md): Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver (CVSS 7.1)
- [CVE-2026-88025](https://cve.now/CVE-2026-88025.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver (CVSS 6.1)
- [CVE-2026-88024](https://cve.now/CVE-2026-88024.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver (CVSS 6.1)
- [CVE-2026-88023](https://cve.now/CVE-2026-88023.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library (CVSS 6.1)
- [CVE-2026-88022](https://cve.now/CVE-2026-88022.md): Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel (CVSS 8.4)
- [CVE-2026-82076](https://cve.now/CVE-2026-82076.md): Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server (CVSS 7.1)
- [CVE-2026-82075](https://cve.now/CVE-2026-82075.md): Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service (CVSS 8.7)
- [CVE-2026-82074](https://cve.now/CVE-2026-82074.md): Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data (CVSS 7.1)
- [CVE-2026-82073](https://cve.now/CVE-2026-82073.md): Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search (CVSS 7.1)
- [CVE-2026-82071](https://cve.now/CVE-2026-82071.md): Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write (CVSS 7.2)
- [CVE-2026-82070](https://cve.now/CVE-2026-82070.md): Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface (CVSS 7.1)
- [CVE-2026-82069](https://cve.now/CVE-2026-82069.md): Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router (CVSS 5.1)
- [CVE-2026-82068](https://cve.now/CVE-2026-82068.md): Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-82067](https://cve.now/CVE-2026-82067.md): Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup (CVSS 9.2)
- [CVE-2026-82066](https://cve.now/CVE-2026-82066.md): Heap Out-of-Bounds Read in MongoDB Server Query Planning Component (CVSS 5.3)
- [CVE-2026-82065](https://cve.now/CVE-2026-82065.md): Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata (CVSS 7.1)
- [CVE-2026-82064](https://cve.now/CVE-2026-82064.md): Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members (CVSS 8.7)
- [CVE-2026-82063](https://cve.now/CVE-2026-82063.md): Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service (CVSS 6.0)
- [CVE-2026-82062](https://cve.now/CVE-2026-82062.md): Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass (CVSS 7.0)
- [CVE-2026-82061](https://cve.now/CVE-2026-82061.md): Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service (CVSS 7.2)
- [CVE-2026-82060](https://cve.now/CVE-2026-82060.md): Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups (CVSS 2.3)
- [CVE-2026-82059](https://cve.now/CVE-2026-82059.md): Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service (CVSS 6.0)
- [CVE-2026-82058](https://cve.now/CVE-2026-82058.md): Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-82057](https://cve.now/CVE-2026-82057.md): Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service (CVSS 7.1)
- [CVE-2026-82056](https://cve.now/CVE-2026-82056.md): Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service (CVSS 6.0)
- [CVE-2026-82055](https://cve.now/CVE-2026-82055.md): Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-82054](https://cve.now/CVE-2026-82054.md): Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-82053](https://cve.now/CVE-2026-82053.md): Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment (CVSS 7.6)
- [CVE-2026-82052](https://cve.now/CVE-2026-82052.md): $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars (CVSS 7.1)
- [CVE-2026-84968](https://cve.now/CVE-2026-84968.md): Heap out-of-bounds read via corrupt nested BSON in field path error message (CVSS 6.9)
- [CVE-2026-84967](https://cve.now/CVE-2026-84967.md): Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (CVSS 5.1)
- [CVE-2026-84962](https://cve.now/CVE-2026-84962.md): Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVSS 5.7)
- [CVE-2026-84963](https://cve.now/CVE-2026-84963.md): Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVSS 6.3)
- [CVE-2026-84964](https://cve.now/CVE-2026-84964.md): Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVSS 8.2)
- [CVE-2026-84965](https://cve.now/CVE-2026-84965.md): Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVSS 5.9)
- [CVE-2026-84966](https://cve.now/CVE-2026-84966.md): BSON element injection via NUL-embedded document keys in builder append (CVSS 5.9)
- [CVE-2026-84969](https://cve.now/CVE-2026-84969.md): Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (CVSS 6.3)
- [CVE-2026-84971](https://cve.now/CVE-2026-84971.md): Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVSS 7.1)
- [CVE-2026-84970](https://cve.now/CVE-2026-84970.md): Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (CVSS 5.9)
- [CVE-2026-81533](https://cve.now/CVE-2026-81533.md): MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values (CVSS 6.0)
- [CVE-2026-81532](https://cve.now/CVE-2026-81532.md): BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption (CVSS 8.7)
- [CVE-2026-81520](https://cve.now/CVE-2026-81520.md): MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion (CVSS 8.7)
- [CVE-2026-81518](https://cve.now/CVE-2026-81518.md): BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections (CVSS 8.7)
- [CVE-2026-81517](https://cve.now/CVE-2026-81517.md): MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service (CVSS 8.7)
- [CVE-2026-81490](https://cve.now/CVE-2026-81490.md): MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service (CVSS 8.3)
- [CVE-2026-77586](https://cve.now/CVE-2026-77586.md): MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output (CVSS 8.5)
- [CVE-2026-77184](https://cve.now/CVE-2026-77184.md): MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output (CVSS 5.6)
- [CVE-2026-76798](https://cve.now/CVE-2026-76798.md): MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports (CVSS 6.9)
- [CVE-2026-76797](https://cve.now/CVE-2026-76797.md): MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports (CVSS 5.8)
- [CVE-2026-76794](https://cve.now/CVE-2026-76794.md): MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata (CVSS 4.8)
- [CVE-2026-81530](https://cve.now/CVE-2026-81530.md): KMS master key exposure via unredacted credential serialization in driver settings string (CVSS 6.8)
- [CVE-2026-81529](https://cve.now/CVE-2026-81529.md): Connection-option injection via unescaped settings in the canonical MongoDB URL builder (CVSS 7.1)
- [CVE-2026-81528](https://cve.now/CVE-2026-81528.md): NoSQL injection via array replacement bypassing update shape validation in driver write path (CVSS 5.3)
- [CVE-2026-81527](https://cve.now/CVE-2026-81527.md): NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation (CVSS 6.9)
- [CVE-2026-81526](https://cve.now/CVE-2026-81526.md): Cross-database write redirection via unvalidated dotted database name in bulk write namespaces (CVSS 7.1)
- [CVE-2026-81525](https://cve.now/CVE-2026-81525.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver (CVSS 8.6)
- [CVE-2026-81524](https://cve.now/CVE-2026-81524.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver (CVSS 5.3)
- [CVE-2026-81523](https://cve.now/CVE-2026-81523.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt (CVSS 2.0)
- [CVE-2026-81522](https://cve.now/CVE-2026-81522.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver (CVSS 8.6)
- [CVE-2026-81521](https://cve.now/CVE-2026-81521.md): Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver (CVSS 7.1)
- [CVE-2026-75573](https://cve.now/CVE-2026-75573.md): MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied (CVSS 4.1)
- [CVE-2026-75159](https://cve.now/CVE-2026-75159.md): MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination (CVSS 8.2)
- [CVE-2026-19003](https://cve.now/CVE-2026-19003.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings (CVSS 8.4)
- [CVE-2026-19004](https://cve.now/CVE-2026-19004.md): MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters (CVSS 8.8)
- [CVE-2026-18888](https://cve.now/CVE-2026-18888.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data (CVSS 7.1)
- [CVE-2026-19001](https://cve.now/CVE-2026-19001.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names (CVSS 9.5)
- [CVE-2026-19002](https://cve.now/CVE-2026-19002.md): Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver (CVSS 8.8)
- [CVE-2026-19503](https://cve.now/CVE-2026-19503.md): Insufficient OIDC endpoint validation could invoke unintended local protocol handlers (CVSS 6.3)
- [CVE-2026-19502](https://cve.now/CVE-2026-19502.md): Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI (CVSS 6.8)
- [CVE-2026-18710](https://cve.now/CVE-2026-18710.md): Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization (CVSS 8.2)
- [CVE-2026-18712](https://cve.now/CVE-2026-18712.md): Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections (CVSS 7.2)
- [CVE-2026-18711](https://cve.now/CVE-2026-18711.md): Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1)
- [CVE-2026-18709](https://cve.now/CVE-2026-18709.md): Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency (CVSS 5.9)
- [CVE-2026-18698](https://cve.now/CVE-2026-18698.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command (CVSS 5.3)
- [CVE-2026-18690](https://cve.now/CVE-2026-18690.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections (CVSS 7.2)
- [CVE-2026-18699](https://cve.now/CVE-2026-18699.md): Improper Input Validation in MongoDB Query Planner Leads to Denial of Service (CVSS 6.0)
- [CVE-2026-18691](https://cve.now/CVE-2026-18691.md): Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure (CVSS 9.0)
- [CVE-2026-18702](https://cve.now/CVE-2026-18702.md): Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings (CVSS 5.3)
- [CVE-2026-18694](https://cve.now/CVE-2026-18694.md): Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1)
- [CVE-2026-18708](https://cve.now/CVE-2026-18708.md): Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes (CVSS 5.3)
- [CVE-2026-18696](https://cve.now/CVE-2026-18696.md): Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections (CVSS 7.0)
- [CVE-2026-18700](https://cve.now/CVE-2026-18700.md): Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service (CVSS 6.0)
- [CVE-2026-18701](https://cve.now/CVE-2026-18701.md): Type Confusion in MongoDB Query Subsystem Leads to Denial of Service (CVSS 7.1)
- [CVE-2026-18697](https://cve.now/CVE-2026-18697.md): Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos (CVSS 8.7)
- [CVE-2026-18693](https://cve.now/CVE-2026-18693.md): Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mongodb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.