MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-20327MongoDB Node.js client side field level encryption library may not be validating KMS certificate
- CVE-2021-20335SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
- CVE-2019-20925Denial of service via malformed network packet
- CVE-2020-7927Potential privilege escalation in Ops Manager API
- CVE-2018-20803Infinite loop in aggregation expression
- CVE-2020-7928Improper neutralization of null byte leads to read overrun
- CVE-2019-2393Crash while joining collections with $lookup
- CVE-2019-20923Crash while handling internal Javascript exception types
- CVE-2019-20924Invariant in IndexBoundsBuilder
- CVE-2019-2392$mod can result in undefined behavior
- CVE-2018-20805Invariant with $elemMatch
- CVE-2018-20802Post-auth queries on compound index may crash mongod
- CVE-2018-20804Invariant failure in applyOps
- CVE-2020-7926Specific query can cause a DoS against MongoDB Server
- CVE-2020-7925Denial of Service when processing malformed Role names
- CVE-2020-7923Specific GeoQuery can cause DoS against MongoDB Server
- CVE-2019-2388Potential exposure of log information in Ops Manager
- CVE-2020-7921Administrative action may disable enforcement of per-user IP whitelisting
- CVE-2020-7922Kubernetes Operator generates potentially insecure certificates
- CVE-2019-2391JS-bson may incorrectly serialise some requests
- CVE-2019-2389Process termination via PID file manipulation
- CVE-2019-2390Code execution on Windows via OpenSSL engine injection
- CVE-2019-2386Authorization session conflation