MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-112368Unbounded Recursion in phongo_bson_visit_document/visit_array:
- CVE-2026-104005Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
- CVE-2026-104004Collection validators using collation-accepting expressions can crash MongoDB Server on insert
- CVE-2026-103965Fixed values in MongoDB Server $bucket stage may be misread as field references
- CVE-2026-96299Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
- CVE-2026-96297MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
- CVE-2026-87109Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
- CVE-2026-87108Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
- CVE-2026-87110Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
- CVE-2026-106435Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
- CVE-2026-106436Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
- CVE-2026-106432Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
- CVE-2026-107325Application denial of service via missing BSON array length validation in MongoDB Go Driver
- CVE-2026-107324Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
- CVE-2026-106434Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
- CVE-2026-106433Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
- CVE-2026-106429Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
- CVE-2026-106430Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
- CVE-2026-106438Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
- CVE-2026-106437Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
- CVE-2026-106431One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
- CVE-2026-106428Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
- CVE-2026-103546Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
- CVE-2026-96749Heap out-of-bounds write via signed size overflow in BSON document encoding
- CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hosts
- CVE-2026-96747Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
- CVE-2026-96745PHP object injection via unsuppressible __pclass class inference in command monitoring events
- CVE-2026-96746Heap buffer overflow via mid-scan command list growth in client topology monitoring
- CVE-2026-96750Shell script injection via server-supplied database name in Open MongoDB shell
- CVE-2026-96744Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel