Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays.Check if you run itEPSS 0.38%Jun 12, 2026
- High7.1An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 commandCheck if you run itEPSS 0.22%Jun 9, 2026
- High7.2The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or c…Check if you run itEPSS 0.30%Jun 9, 2026
- High7.1An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with…Check if you run itEPSS 0.27%Jun 9, 2026
- Medium6.8The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.Check if you run itEPSS 0.11%Jun 9, 2026
- High7.1An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution.Check if you run itEPSS 0.37%Jun 9, 2026
- High7.1This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery.Check if you run itEPSS 0.27%Jun 9, 2026
- High7.1The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed.Check if you run itEPSS 0.32%Jun 9, 2026
- High7.1Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.Check if you run itEPSS 0.27%Jun 9, 2026
- High7.1When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash.Check if you run itEPSS 0.27%Jun 9, 2026
- High7.1In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines.Check if you run itEPSS 0.31%Jun 9, 2026
- High8.2When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash.Check if you run itEPSS 0.35%Jun 9, 2026
- High7.1A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in litera…Check if you run itEPSS 0.10%Jun 9, 2026
- High8.7A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message.Check if you run itEPSS 0.34%Jun 9, 2026
- Medium6.8MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication.Check if you run itEPSS 0.12%Jun 9, 2026
- High7.1Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that ind…Check if you run itEPSS 0.24%May 18, 2026
- High7.7After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subse…Check if you run itEPSS 0.26%May 13, 2026
- Medium5.3Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation pe…Check if you run itEPSS 0.26%May 13, 2026
- Medium6.1A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared.Check if you run itEPSS 0.13%May 13, 2026
- Medium4.8When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have al…Check if you run itEPSS 0.20%May 13, 2026
- High7.1An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.Check if you run itEPSS 0.26%May 13, 2026
- High8.7An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write…Check if you run itEPSS 0.66%May 13, 2026
- High7.1An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.Check if you run itEPSS 0.23%May 7, 2026
- Medium6.1Redis is an in-memory data structure store.Check if you run itEPSS 3.09%May 5, 2026
- High7.7Redis is an in-memory data structure store.Patch nowKEVEPSS 4.03%May 5, 2026
Sort