mongodb

Latest CVEs · RSS

• CVE-2026-104005 2026-10-13 · CVSS 7.1
  A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos proc
• CVE-2026-104004 2026-10-13 · CVSS 7.1
  MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server proce
• CVE-2026-103965 2026-10-13 · CVSS 5.3
  An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain co
• CVE-2026-96299 2026-10-13 · CVSS 7.1
  A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos proc
• CVE-2026-96297 2026-10-13 · CVSS 6.0
  Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an intern
• CVE-2026-87109 2026-10-09 · CVSS 6.0
  An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that m
• CVE-2026-87108 2026-10-09 · CVSS 2.3
  An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they posses
• CVE-2026-87110 2026-10-09 · CVSS 6.9
  An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiti
• CVE-2026-106435 2026-10-08 · CVSS 5.9
  The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression el
• CVE-2026-106436 2026-10-08 · CVSS 6.3
  The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an inv
• CVE-2026-106432 2026-10-08 · CVSS 2.0
  The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 G
• CVE-2026-107325 2026-10-08 · CVSS 8.2
  Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.V
• CVE-2026-107324 2026-10-08 · CVSS 8.2
  An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON
• CVE-2026-106434 2026-10-08 · CVSS 5.3
  The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An ac
• CVE-2026-106433 2026-10-08 · CVSS 8.7
  Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document contai
• CVE-2026-106429 2026-10-08 · CVSS 7.1
  An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This ca
• CVE-2026-106430 2026-10-08 · CVSS 6.0
  The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driv
• CVE-2026-106438 2026-10-08 · CVSS 5.1
  An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejec
• CVE-2026-106437 2026-10-08 · CVSS 5.9
  The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can u
• CVE-2026-106431 2026-10-08 · CVSS 5.9
  An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at
• CVE-2026-106428 2026-10-08 · CVSS 6.3
  An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed
• CVE-2026-103546 2026-10-05 · CVSS 2.3
  In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource
• CVE-2026-96749 2026-09-24 · CVSS 7.5
  An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built fr
• CVE-2026-96748 2026-09-24 · CVSS 8.3
  PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an applicat
• CVE-2026-96747 2026-09-24 · CVSS 5.3
  The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain s