MongoDB vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
84 matching records
- Low2.0A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.Check if you run itEPSS 0.19%Mar 17, 2026
- Medium6.1A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-ba…Check if you run itEPSS 0.36%Mar 17, 2026
- High8.7A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup…Check if you run itEPSS 0.34%Mar 17, 2026
- High7.1An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.Check if you run itEPSS 0.22%Mar 17, 2026
- Critical9.8On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions.Check if you run itEPSS 0.40%Mar 2, 2026
- Medium6.5Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network tCheck if you run itEPSS 0.23%Jan 14, 2026
- High8.7MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency VulnerabilityPatch nowKEVEPSS 83.22%Dec 19, 2025
- Low2.3A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific condCheck if you run itEPSS 0.22%Dec 9, 2025
- High7.1MongoDB Server may experience an invariant failure during batched delete operations when handling documents.Check if you run itEPSS 0.35%Nov 25, 2025
- Low2.3A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users.Check if you run itEPSS 0.24%Nov 25, 2025
- Low2.3Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirementCheck if you run itEPSS 0.10%Nov 25, 2025
- High7.1Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination.Check if you run itEPSS 0.31%Nov 25, 2025
- Medium6.9A mongoc_bulk_operation_t may read invalid memory if large options are passed.Check if you run itEPSS 0.21%Nov 18, 2025
- Medium5.4When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller.Check if you run itEPSS 0.26%Nov 14, 2025
- Medium5.9The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects.Check if you run itEPSS 0.39%Nov 3, 2025
- High8.8Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.Check if you run itEPSS 0.17%Oct 23, 2025
- High8.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 thrCheck if you run itEPSS 0.14%Oct 23, 2025
- High7.5Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause incomplete or missinCheck if you run itEPSS 0.36%Oct 20, 2025
- High8.6Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizCheck this weekEPSS 25.35%Sep 25, 2025
- High7.8The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijCheck if you run itEPSS 0.12%Sep 15, 2025
- Medium6.5An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query.Check if you run itEPSS 0.32%Sep 5, 2025
- Medium6.5MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commitCheck if you run itEPSS 0.38%Sep 5, 2025
- Medium6.5An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers.Check if you run itEPSS 0.29%Sep 5, 2025
- Medium6.5An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash.Check if you run itEPSS 0.35%Jul 7, 2025
- High7.5MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data.Check if you run itEPSS 0.36%Jul 7, 2025