https://vulnogram.org/ Most recent CVEs assigned by MongoDB, Inc. (mongodb). https://vulnogram.org/seaview/icons/mongodb.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-112368 https://vulnogram.org/CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using t… High Network Exploitable Mon, 19 Oct 2026 15:49:16 GMT https://vulnogram.org/CVE-2026-104005 https://vulnogram.org/CVE-2026-104005 A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal a… High Tue, 13 Oct 2026 15:38:42 GMT https://vulnogram.org/CVE-2026-104004 https://vulnogram.org/CVE-2026-104004 MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authentic… High Tue, 13 Oct 2026 15:36:14 GMT https://vulnogram.org/CVE-2026-103965 https://vulnogram.org/CVE-2026-103965 An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation o… Medium Tue, 13 Oct 2026 15:33:20 GMT https://vulnogram.org/CVE-2026-96299 https://vulnogram.org/CVE-2026-96299 A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal a… High Tue, 13 Oct 2026 15:27:57 GMT https://vulnogram.org/CVE-2026-96297 https://vulnogram.org/CVE-2026-96297 Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory t… Medium Tue, 13 Oct 2026 15:23:57 GMT https://vulnogram.org/CVE-2026-87109 https://vulnogram.org/CVE-2026-87109 An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication mat… Medium Fri, 09 Oct 2026 05:56:06 GMT https://vulnogram.org/CVE-2026-87108 https://vulnogram.org/CVE-2026-87108 An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment… Low Fri, 09 Oct 2026 05:54:58 GMT https://vulnogram.org/CVE-2026-87110 https://vulnogram.org/CVE-2026-87110 An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests cont… Medium Network Exploitable Fri, 09 Oct 2026 05:52:14 GMT https://vulnogram.org/CVE-2026-106435 https://vulnogram.org/CVE-2026-106435 The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode o… Medium Thu, 08 Oct 2026 20:12:15 GMT https://vulnogram.org/CVE-2026-106436 https://vulnogram.org/CVE-2026-106436 The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an un… Medium Network Exploitable Thu, 08 Oct 2026 19:03:31 GMT https://vulnogram.org/CVE-2026-106432 https://vulnogram.org/CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The re… Low Thu, 08 Oct 2026 19:02:25 GMT https://vulnogram.org/CVE-2026-107325 https://vulnogram.org/CVE-2026-107325 Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated acto… High Network Exploitable Thu, 08 Oct 2026 19:01:01 GMT https://vulnogram.org/CVE-2026-107324 https://vulnogram.org/CVE-2026-107324 An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application ma… High Network Exploitable Thu, 08 Oct 2026 18:58:01 GMT https://vulnogram.org/CVE-2026-106434 https://vulnogram.org/CVE-2026-106434 The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network… Medium Thu, 08 Oct 2026 18:56:43 GMT https://vulnogram.org/CVE-2026-106433 https://vulnogram.org/CVE-2026-106433 Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents… High Thu, 08 Oct 2026 18:55:34 GMT https://vulnogram.org/CVE-2026-106429 https://vulnogram.org/CVE-2026-106429 An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or… High Thu, 08 Oct 2026 18:54:10 GMT https://vulnogram.org/CVE-2026-106430 https://vulnogram.org/CVE-2026-106430 The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated ac… Medium Thu, 08 Oct 2026 18:45:56 GMT https://vulnogram.org/CVE-2026-106438 https://vulnogram.org/CVE-2026-106438 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provid… Medium Thu, 08 Oct 2026 18:44:05 GMT https://vulnogram.org/CVE-2026-106437 https://vulnogram.org/CVE-2026-106437 The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An ac… Medium Thu, 08 Oct 2026 18:42:14 GMT https://vulnogram.org/CVE-2026-106431 https://vulnogram.org/CVE-2026-106431 An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by… Medium Thu, 08 Oct 2026 18:40:32 GMT https://vulnogram.org/CVE-2026-106428 https://vulnogram.org/CVE-2026-106428 An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before… Medium Network Exploitable Thu, 08 Oct 2026 18:35:02 GMT https://vulnogram.org/CVE-2026-103546 https://vulnogram.org/CVE-2026-103546 In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using… Medium Mon, 05 Oct 2026 21:50:14 GMT https://vulnogram.org/CVE-2026-96749 https://vulnogram.org/CVE-2026-96749 An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a si… High Thu, 24 Sep 2026 18:18:13 GMT https://vulnogram.org/CVE-2026-96748 https://vulnogram.org/CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string,… High Network Exploitable Thu, 24 Sep 2026 18:18:12 GMT https://vulnogram.org/CVE-2026-96747 https://vulnogram.org/CVE-2026-96747 The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metad… Medium Thu, 24 Sep 2026 18:18:10 GMT https://vulnogram.org/CVE-2026-96745 https://vulnogram.org/CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command mo… Medium Network Exploitable Thu, 24 Sep 2026 15:51:16 GMT https://vulnogram.org/CVE-2026-96746 https://vulnogram.org/CVE-2026-96746 An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap b… High Network Exploitable Thu, 24 Sep 2026 15:51:15 GMT https://vulnogram.org/CVE-2026-96750 https://vulnogram.org/CVE-2026-96750 MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user co… High Thu, 24 Sep 2026 15:51:13 GMT https://vulnogram.org/CVE-2026-96744 https://vulnogram.org/CVE-2026-96744 Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal… High Thu, 24 Sep 2026 15:51:12 GMT https://vulnogram.org/CVE-2026-93759 https://vulnogram.org/CVE-2026-93759 Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a… High Network Exploitable Fri, 18 Sep 2026 17:27:51 GMT https://vulnogram.org/CVE-2026-93760 https://vulnogram.org/CVE-2026-93760 Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party wi… High Network Exploitable Fri, 18 Sep 2026 17:24:03 GMT https://vulnogram.org/CVE-2026-93761 https://vulnogram.org/CVE-2026-93761 An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place us… High Network Exploitable Fri, 18 Sep 2026 17:20:34 GMT https://vulnogram.org/CVE-2026-93762 https://vulnogram.org/CVE-2026-93762 Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disc… Critical Network Exploitable Fri, 18 Sep 2026 17:15:17 GMT https://vulnogram.org/CVE-2026-93763 https://vulnogram.org/CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning.… High Fri, 18 Sep 2026 17:10:24 GMT https://vulnogram.org/CVE-2026-93764 https://vulnogram.org/CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with n… High Fri, 18 Sep 2026 17:06:27 GMT https://vulnogram.org/CVE-2026-93765 https://vulnogram.org/CVE-2026-93765 Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method i… Critical Network Exploitable Fri, 18 Sep 2026 17:01:09 GMT https://vulnogram.org/CVE-2026-93758 https://vulnogram.org/CVE-2026-93758 An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause… High Fri, 18 Sep 2026 16:56:41 GMT https://vulnogram.org/CVE-2026-93395 https://vulnogram.org/CVE-2026-93395 A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify… Medium Network Exploitable Thu, 17 Sep 2026 20:34:57 GMT https://vulnogram.org/CVE-2026-93394 https://vulnogram.org/CVE-2026-93394 A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man… Medium Network Exploitable Thu, 17 Sep 2026 20:31:27 GMT https://vulnogram.org/CVE-2026-93393 https://vulnogram.org/CVE-2026-93393 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds… Critical Network Exploitable Thu, 17 Sep 2026 20:26:38 GMT https://vulnogram.org/CVE-2026-92757 https://vulnogram.org/CVE-2026-92757 Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. Medium Thu, 17 Sep 2026 19:20:37 GMT https://vulnogram.org/CVE-2026-92758 https://vulnogram.org/CVE-2026-92758 If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. Medium Thu, 17 Sep 2026 19:16:13 GMT https://vulnogram.org/CVE-2026-92756 https://vulnogram.org/CVE-2026-92756 Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in t… Medium Thu, 17 Sep 2026 19:04:51 GMT https://vulnogram.org/CVE-2026-89099 https://vulnogram.org/CVE-2026-89099 A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privile… High Fri, 11 Sep 2026 17:39:58 GMT https://vulnogram.org/CVE-2026-88036 https://vulnogram.org/CVE-2026-88036 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An auth… High Thu, 10 Sep 2026 18:09:10 GMT https://vulnogram.org/CVE-2026-88035 https://vulnogram.org/CVE-2026-88035 A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause t… Medium Thu, 10 Sep 2026 18:07:10 GMT https://vulnogram.org/CVE-2026-88034 https://vulnogram.org/CVE-2026-88034 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An au… High Thu, 10 Sep 2026 18:05:31 GMT https://vulnogram.org/CVE-2026-88033 https://vulnogram.org/CVE-2026-88033 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An a… High Thu, 10 Sep 2026 18:04:01 GMT https://vulnogram.org/CVE-2026-88032 https://vulnogram.org/CVE-2026-88032 A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such… High Network Exploitable Thu, 10 Sep 2026 18:02:13 GMT