Latest vulnerabilities for "mongodb mongodb"

MongoDB MongoDBServer crash via aggregation pipeline expression with compound wildcard index specification

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13055

MongoDB MongoDBA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13056

MongoDB MongoDBAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

Risk 38

Severity

6

First published (updated )

CVE-2026-13057

MongoDB MongoDBTransaction Command Insufficient Input Validation Leading to Process Termination

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13058

MongoDB MongoDBImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

Risk 62

Severity

8.6

First published (updated )

CVE-2026-13059

MongoDB MongoDBFind command with $meta sort can lead to crash

Risk 29

Severity

7.1

EPSS

0.24%

First published (updated )

CVE-2026-9737

MongoDB MongoDB$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13060

MongoDB MongoDBImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

Risk 26

Severity

5.3

First published (updated )

CVE-2026-13061

MongoDB MongoDBMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13062

MongoDB MongoDBlibmongocrypt Improper Input Validation Leading to Process Termination

Risk 38

Severity

5.3

First published (updated )

CVE-2026-13063

MongoDB MongoDBMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13064

MongoDB MongoDBMongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13065

MongoDB MongoDBServer-Side JavaScript DBPointer BSON Serialization Memory Disclosure

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13066

MongoDB MongoDBtlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

Risk 51

Severity

7.2

First published (updated )

CVE-2026-13067

MongoDB MongoDBMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

Risk 22

Severity

2.3

First published (updated )

CVE-2026-13068

MongoDB MongoDBQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

Risk 40

Severity

7.1

First published (updated )

CVE-2026-13069

MongoDB MongoDBImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

Risk 35

Severity

6

First published (updated )

CVE-2026-13070

MongoDB MongoDBMongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

Risk 26

Severity

5.3

First published (updated )

CVE-2026-13073

MongoDB MongoDBAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

Risk 33

Severity

6.9

First published (updated )

CVE-2026-13074

MongoDB MongoDBPost-authentication use-after-free in server-side JavaScript BSON-to-array conversion

Risk 79

Severity

8.7

First published (updated )

CVE-2026-11933

MongoDB MongoDBUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

Risk 33

Severity

8.7

EPSS

0.34%

First published (updated )

CVE-2026-9740

MongoDB MongoDB ServerKeyfile contents are in MongoDB Server logs

Risk 27

Severity

6.8

EPSS

0.12%

First published (updated )

CVE-2026-9735

MongoDB MongoDBStack memory disclosure in filemd5 command

Risk 29

Severity

7.1

EPSS

0.22%

First published (updated )

CVE-2026-9754

MongoDB MongoDBServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Risk 43

Severity

7.2

EPSS

0.30%

First published (updated )

CVE-2026-9753

MongoDB MongoDBGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9752

MongoDB MongoDBSensitive data could be written to mongod.log

Risk 27

Severity

6.8

EPSS

0.11%

First published (updated )

CVE-2026-9751

MongoDB MongoDBMetadata name collision on $-prefixed fields causes post-auth server crash

Risk 29

Severity

7.1

EPSS

0.37%

First published (updated )

CVE-2026-9750

MongoDB MongoDBUsing MaxKey() may crash the server

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9749

MongoDB MongoDB$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Risk 29

Severity

7.1

EPSS

0.32%

First published (updated )

CVE-2026-9748

MongoDB MongoDBCrafted cross-shard merge aggregation crashes MongoDB Server

Risk 29

Severity

7.1

EPSS

0.27%

First published (updated )

CVE-2026-9747

Trending

Versions

MongoDB MongoDBServer crash via aggregation pipeline expression with compound wildcard index specification

MongoDB MongoDBA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

MongoDB MongoDBAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

MongoDB MongoDBTransaction Command Insufficient Input Validation Leading to Process Termination

MongoDB MongoDBImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

Don't miss critical vulnerabilities

MongoDB MongoDBFind command with $meta sort can lead to crash

MongoDB MongoDB$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

MongoDB MongoDBImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

MongoDB MongoDBMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

MongoDB MongoDBlibmongocrypt Improper Input Validation Leading to Process Termination

Don't miss critical vulnerabilities

MongoDB MongoDBMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

MongoDB MongoDBMongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

MongoDB MongoDBServer-Side JavaScript DBPointer BSON Serialization Memory Disclosure

MongoDB MongoDBtlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

MongoDB MongoDBMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

Don't miss critical vulnerabilities

MongoDB MongoDBQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

MongoDB MongoDBImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

MongoDB MongoDBMongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

MongoDB MongoDBAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

MongoDB MongoDBPost-authentication use-after-free in server-side JavaScript BSON-to-array conversion

Don't miss critical vulnerabilities

MongoDB MongoDBUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

MongoDB MongoDB ServerKeyfile contents are in MongoDB Server logs

MongoDB MongoDBStack memory disclosure in filemd5 command

MongoDB MongoDBServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.

MongoDB MongoDBGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Don't miss critical vulnerabilities

MongoDB MongoDBSensitive data could be written to mongod.log

MongoDB MongoDBMetadata name collision on $-prefixed fields causes post-auth server crash

MongoDB MongoDBUsing MaxKey() may crash the server

MongoDB MongoDB$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

MongoDB MongoDBCrafted cross-shard merge aggregation crashes MongoDB Server

Don't miss critical vulnerabilities

Company

Resources

Contact