Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case.Check if you run itEPSS 0.42%Jul 22, 2026
- Medium6.3A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript…Check if you run itEPSS 0.38%Jul 22, 2026
- High7.1A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline.Check if you run itEPSS 0.42%Jul 22, 2026
- High7.1An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion opera…Check if you run itEPSS 0.42%Jul 22, 2026
- High7.1An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages.Check if you run itEPSS 0.42%Jul 22, 2026
- Medium6.9An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command…Check if you run itEPSS 0.44%Jul 22, 2026
- Medium5.3An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of s…Check if you run itEPSS 0.37%Jul 22, 2026
- Critical9.2When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result…Check if you run itEPSS 0.40%Jul 22, 2026
- High7.1An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript.Check if you run itEPSS 0.42%Jul 22, 2026
- Medium6.0A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake.Check if you run itEPSS 0.13%Jul 22, 2026
- High7.1An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload contai…Check if you run itEPSS 0.29%Jul 22, 2026
- Low2.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting…Check if you run itEPSS 0.25%Jul 22, 2026
- High7.2When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list.Check if you run itEPSS 0.10%Jul 22, 2026
- High7.1Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being includ…Check if you run itEPSS 0.37%Jul 22, 2026
- High7.1A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to caus…Check if you run itEPSS 0.50%Jul 22, 2026
- High7.1Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leadi…Check if you run itEPSS 0.45%Jul 22, 2026
- Medium5.3An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command.Check if you run itEPSS 0.40%Jul 22, 2026
- High7.1An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to…Check if you run itEPSS 0.19%Jul 22, 2026
- Medium5.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage.Check if you run itEPSS 0.28%Jul 22, 2026
- High7.1An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the…Check if you run itEPSS 0.43%Jul 22, 2026
- High8.6An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insu…Check if you run itEPSS 0.38%Jul 22, 2026
- High7.1An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set…Check if you run itEPSS 0.40%Jul 22, 2026
- Medium6.0An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls.Check if you run itEPSS 0.35%Jul 22, 2026
- High7.1Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.Check if you run itEPSS 0.40%Jul 22, 2026
- High7.1The aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod).Check if you run itEPSS 0.40%Jul 22, 2026
Sort