MongoDB vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
84 matching records
- Medium6.5Waline login accepts a non-string email as a match-all MongoDB queryOpen the advisoryOct 28, 2026
- Medium6.5Waline login accepts a non-string email as a match-all MongoDB queryCheck if you run itEPSS 0.26%Oct 28, 2026
- High8.8Missing AuthorizationCheck if you run itEPSS 0.32%Oct 25, 2026
- CriticalMetasploit Wrap Up: Langflow, MongoDB, and MoreCheck if you run itEPSS 2.18%Oct 23, 2026
- Medium6.9BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guardsCheck if you run itEPSS 0.35%Oct 22, 2026
- High7.1Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderCheck if you run itEPSS 0.21%Oct 22, 2026
- High7.1Update operator injection via single-element list rewriting in the update builderCheck if you run itEPSS 0.30%Oct 22, 2026
- Medium6.3Cross-document data leak via malformed BSON array parsing in reused thread bufferCheck if you run itEPSS 0.39%Oct 22, 2026
- Medium6.9Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameCheck if you run itEPSS 0.11%Oct 22, 2026
- High7.6Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheCheck if you run itEPSS 0.20%Oct 22, 2026
- High7.2NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keysCheck if you run itEPSS 0.32%Oct 22, 2026
- Medium5.3NoSQL operator injection via unvalidated replacement document in findOneAndReplaceCheck if you run itEPSS 0.26%Oct 22, 2026
- Medium6.9NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireCheck if you run itEPSS 0.26%Oct 22, 2026
- Medium5.7MongoDB C Treiber: Schwachstelle ermöglicht Denial of Service und manipulation von DatenCheck if you run itEPSS 0.17%Oct 22, 2026
- High8.2Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserializationCheck if you run itEPSS 0.48%Oct 22, 2026
- Medium5.3Duplicate geometry fields via unvalidated GeoJSON extra membersCheck if you run itEPSS 0.37%Oct 22, 2026
- High8.8MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.Check if you run itEPSS 0.24%Oct 21, 2026
- High8.2MongoDB: Schwachstelle ermöglicht Denial of ServiceCheck if you run itEPSS 0.26%Oct 19, 2026
- High7.1Incorrect authorization in MongoDB Server router for bulk writes to system namespacesCheck if you run itEPSS 0.24%Oct 13, 2026
- High7.1Collection validators using collation-accepting expressions can crash MongoDB Server on insertCheck if you run itEPSS 0.24%Oct 13, 2026
- Medium6.9An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting.Check if you run itEPSS 0.25%Oct 9, 2026
- Medium6.0An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's…Check if you run itEPSS 0.23%Oct 9, 2026
- Low2.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the r…Check if you run itEPSS 0.14%Oct 9, 2026
- Medium5.9MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex elementCheck if you run itEPSS 0.09%Oct 8, 2026
- High8.2Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate…Check if you run itEPSS 0.24%Oct 8, 2026