Mongodb - vulnerabilities (CVEs)

351 CVEs in 55 products, 38 in the last 30 days, newest from 2026-10-28.

Products

• Mongodb - 188 CVEs
• Mongodb Server - 95 CVEs
• C Driver - 36 CVEs
• Bi Connector - 8 CVEs
• Bi Connector Odbc Driver - 8 CVEs
• C# Driver - 8 CVEs
• Mongoid - 8 CVEs
• Php Driver - 8 CVEs
• Libmongocrypt - 7 CVEs
• Ops Manager - 7 CVEs
• Compass - 6 CVEs
• Go Driver - 5 CVEs
• Python Driver - 5 CVEs
• Rust Driver - 5 CVEs
• C++ Driver - 4 CVEs
• Java Driver - 4 CVEs
• Laravel Mongodb Php - 4 CVEs
• Libbson - 4 CVEs
• Mongosh - 4 CVEs
• Bi Connector Transition Readiness Report - 3 CVEs
• Entity Framework Core Provider - 3 CVEs
• Laravel Mongodb - 3 CVEs
• Mongosql Transition Readiness Tool - 3 CVEs
• Atlas Sql Odbc Driver - 2 CVEs
• Bson - 2 CVEs
• Js-bson - 2 CVEs
• Ops Manager Server - 2 CVEs
• Php Library - 2 CVEs
• Schema Builder Cli - 2 CVEs
• Sql Schema Builder Cli - 2 CVEs
• Atlas Kubernetes Operator - 1 CVEs
• Bsonxs - 1 CVEs
• C++ - 1 CVEs
• Database Tools - 1 CVEs
• Mongo-c-driver - 1 CVEs
• Mongo Crypt V1.so - 1 CVEs
• Mongocryptd - 1 CVEs
• Mongodb.libmongocrypt Nuget Package - 1 CVEs
• Mongodb Client Encryption - 1 CVEs
• Mongodb Compass - 1 CVEs
• Mongodb Driver - 1 CVEs
• Mongodb Enterprise Kubernetes Operator - 1 CVEs
• Mongodb For Vs Code - 1 CVEs
• Mongodb Php Library - 1 CVEs
• Mongomirror - 1 CVEs
• Node.js - 1 CVEs
• Odbc Driver - 1 CVEs
• Org.mongodbmongodb-crypt Maven Package - 1 CVEs
• Org.mongodbmongodb-driver-reactivestreams Maven Package - 1 CVEs
• Php Extension - 1 CVEs
• Pymongo - 1 CVEs
• Ruby Driver - 1 CVEs
• Rust-driver - 1 CVEs
• Swift Driver - 1 CVEs
• Kubernetes Operator - 0 CVEs

Newest CVEs of Mongodb

• CVE-2026-116641 - CVSS 7.6 (high), 2026-10-28: The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has…
• CVE-2026-118581 - CVSS 6.9 (medium), 2026-10-28: A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of…
• CVE-2026-118510 - CVSS 8.8 (high), 2026-10-28: A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be…
• CVE-2026-114655 - CVSS 6 (medium), 2026-10-22: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider…
• CVE-2026-114654 - CVSS 6.9 (medium), 2026-10-22: A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted…
• CVE-2026-114653 - CVSS 7.1 (high), 2026-10-22: A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted…
• CVE-2026-114652 - CVSS 7.1 (high), 2026-10-22: A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be…
• CVE-2026-114651 - CVSS 6.3 (medium), 2026-10-22: A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be…
• CVE-2026-114650 - CVSS 6.9 (medium), 2026-10-22: A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written…
• CVE-2026-114649 - CVSS 7.6 (high), 2026-10-22: The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an…
• CVE-2026-114648 - CVSS 7.6 (high), 2026-10-22: The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before…
• CVE-2026-114647 - CVSS 5.3 (medium), 2026-10-22: The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace…
• CVE-2026-114646 - CVSS 6.9 (medium), 2026-10-22: A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON…
• CVE-2026-114645 - CVSS 5.7 (medium), 2026-10-22: A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when…
• CVE-2026-114644 - CVSS 8.2 (high), 2026-10-22: The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An…
• CVE-2026-114643 - CVSS 5.4 (medium), 2026-10-22: The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An…
• CVE-2026-113870 - CVSS 8.8 (high), 2026-10-21: MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a…
• CVE-2026-104005 - CVSS 7.1 (high), 2026-10-13: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos…
• CVE-2026-104004 - CVSS 7.1 (high), 2026-10-13: MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server…
• CVE-2026-103965 - CVSS 5.4 (medium), 2026-10-13: An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain…
• CVE-2026-96299 - CVSS 7.1 (high), 2026-10-13: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos…
• CVE-2026-96297 - CVSS 6.5 (medium), 2026-10-13: Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an…
• CVE-2026-87109 - CVSS 6.5 (medium), 2026-10-09: An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that…
• CVE-2026-87108 - CVSS 4.3 (medium), 2026-10-09: An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they…
• CVE-2026-87110 - CVSS 6.9 (medium), 2026-10-09: An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate…
• CVE-2026-106435 - CVSS 5.9 (medium), 2026-10-08: The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression…
• CVE-2026-106436 - CVSS 6.5 (medium), 2026-10-08: The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an…
• CVE-2026-106432 - CVSS 8.2 (high), 2026-10-08: The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4…
• CVE-2026-107325 - CVSS 8.2 (high), 2026-10-08: Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls…
• CVE-2026-107324 - CVSS 8.2 (high), 2026-10-08: An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed…