Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Incorrect authorization in MongoDB Server router for bulk writes to system namespacesOct 13, 2026
- High7.1Collection validators using collation-accepting expressions can crash MongoDB Server on insertOct 13, 2026
- Medium6.9An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting.Oct 9, 2026
- Medium6.0An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's…Oct 9, 2026
- Low2.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the r…Oct 9, 2026
- Medium5.9The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element w…Oct 8, 2026
- High7.1An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.May 7, 2026
- High8.6The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authenticatio…May 6, 2026
- Medium5.3An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account.Apr 29, 2026
- High7.1Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.Apr 29, 2026
- Medium5.3The bson_validate function may return early on specific inputs and incorrectly report success.Apr 13, 2026
- Medium6.0A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the…Mar 30, 2026
- Low2.0A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.Mar 17, 2026
- Medium6.1A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-ba…Mar 17, 2026
- High8.7A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup…Mar 17, 2026
- High7.1An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.Mar 17, 2026
- Critical9.8On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions.Mar 2, 2026
- High8.7MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency VulnerabilityKEVEPSS 83.2%Dec 19, 2025
- Critical9.9MongoDB mongo-express Remote Code Execution VulnerabilityKEVEPSS 84.7%Dec 24, 2019
19 records · page 1 of 1
PreviousNext