Ops Manager (Mongodb) - vulnerabilities (CVEs)

7 CVEs, 3 in the last 30 days, 255 known versions, newest CVE from 2026-10-09. Vendor: Mongodb.

CVEs of Ops Manager

• CVE-2026-87109 - CVSS 6.5 (medium), 2026-10-09: An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that…
• CVE-2026-87108 - CVSS 4.3 (medium), 2026-10-09: An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they…
• CVE-2026-87110 - CVSS 6.9 (medium), 2026-10-09: An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate…
• CVE-2026-8431 - CVSS 9.4 (critical), 2026-05-12: An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific…
• CVE-2021-20335 - CVSS 6.7 (medium), 2021-02-11: For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the…
• CVE-2020-7927 - CVSS 8.1 (high), 2020-11-23: Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue…
• CVE-2019-2388 - CVSS 5.8 (medium), 2020-05-13: In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager…