MongoDB vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
84 matching records
- High8.2An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document.Check if you run itEPSS 0.23%Oct 8, 2026
- Medium5.1An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them.Check if you run itEPSS 0.14%Oct 8, 2026
- Medium5.9The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum.Check if you run itEPSS 0.13%Oct 8, 2026
- High8.7Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing du…Check if you run itEPSS 0.26%Oct 8, 2026
- Critical9.8Metasploit Wrap Up: Langflow, MongoDB, and MoreCheck this weekEPSS 15.29%Oct 7, 2026
- Critical9.3ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin.Check if you run itEPSS 0.66%Aug 18, 2026
- Critical10.0Metasploit Wrap Up: Langflow, MongoDB, and MoreCheck if you run itEPSS 2.32%Jun 30, 2026
- Medium5.3Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior le…Check if you run itEPSS 0.41%May 20, 2026
- Medium6.0The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.Check if you run itEPSS 0.30%May 20, 2026
- High7.1Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that ind…Check if you run itEPSS 0.24%May 18, 2026
- Medium6.0Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the s…Check if you run itEPSS 0.37%May 14, 2026
- High7.5Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.Check if you run itEPSS 0.27%May 14, 2026
- High7.7After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subse…Check if you run itEPSS 0.26%May 13, 2026
- Medium5.3Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation pe…Check if you run itEPSS 0.26%May 13, 2026
- Medium6.1A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared.Check if you run itEPSS 0.13%May 13, 2026
- Medium4.8When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have al…Check if you run itEPSS 0.20%May 13, 2026
- High7.1An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.Check if you run itEPSS 0.26%May 13, 2026
- High8.7An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write…Check if you run itEPSS 0.66%May 13, 2026
- Critical9.4An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.Check if you run itEPSS 0.37%May 12, 2026
- High7.1An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.Check if you run itEPSS 0.23%May 7, 2026
- High8.6The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authenticatio…Check if you run itEPSS 0.13%May 6, 2026
- Medium5.3An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account.Check if you run itEPSS 0.17%Apr 29, 2026
- High7.1Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.Check if you run itEPSS 0.26%Apr 29, 2026
- Medium5.3The bson_validate function may return early on specific inputs and incorrectly report success.Check if you run itEPSS 0.18%Apr 13, 2026
- Medium6.0A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the…Check if you run itEPSS 0.21%Mar 30, 2026