MONGODB MongoDB Server

• CVE-2026-18687 High 7.1 Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption 0.2%
• CVE-2026-18706 Medium 6.6 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution 0.5%
• CVE-2026-18707 Medium 4.3 Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service 0.4%
• CVE-2026-18703 Medium 4.2 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method 0.1%
• CVE-2026-13055 Medium 6.5 Server crash via aggregation pipeline expression with compound wildcard index specification 0.4%
• CVE-2026-13056 Medium 6.5 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM 0.4%
• CVE-2026-13057 Medium 5.3 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META 0.3%
• CVE-2026-13058 High 7.1 Transaction Command Insufficient Input Validation Leading to Process Termination 0.4%
• CVE-2026-13059 High 8.1 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass 0.4%
• CVE-2026-9737 Medium 6.5 Find command with $meta sort can lead to crash 0.4%
• CVE-2026-13060 Medium 6.5 $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access 0.4%
• CVE-2026-13061 Medium 4.3 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage 0.3%
• CVE-2026-13062 Medium 6.5 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters 0.2%
• CVE-2026-13063 Medium 4.3 libmongocrypt Improper Input Validation Leading to Process Termination 0.4%
• CVE-2026-13064 Medium 6.5 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service 0.5%
• CVE-2026-13065 Medium 6.5 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination 0.5%
• CVE-2026-13066 Medium 6.5 Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure 0.4%
• CVE-2026-13067 Medium 6.3 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket <0.1%
• CVE-2026-13068 Medium 4.2 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse 0.3%
• CVE-2026-13069 Medium 6.5 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion 0.3%
• CVE-2026-13070 Medium 5.3 Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination 0.1%
• CVE-2026-13071 Medium 6.5 Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination 0.4%
• CVE-2026-13072 High 8.1 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption 0.4%
• CVE-2026-13073 Medium 4.3 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination 0.4%
• CVE-2026-13074 Medium 5.3 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service 0.4%
• CVE-2026-13075 Medium 6.5 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation 0.4%
• CVE-2026-13076 Medium 6.5 Aggregation Framework Memory Exhaustion Leading to Process Termination 0.4%
• CVE-2026-13077 High 7.1 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data 0.4%
• CVE-2026-13078 High 7.7 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader 0.4%
• CVE-2026-9740 High 7.5 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow 0.3%
• CVE-2026-9735 Medium 5.5 Keyfile contents are in MongoDB Server logs 0.1%
• CVE-2026-9753 High 8.1 Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. 0.3%
• CVE-2026-9752 Medium 6.5 GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation 0.3%
• CVE-2026-9751 Medium 5.5 Sensitive data could be written to mongod.log 0.1%
• CVE-2026-9750 Medium 6.5 Metadata name collision on $-prefixed fields causes post-auth server crash 0.4%
• CVE-2026-9749 Medium 6.5 Using MaxKey() may crash the server 0.3%
• CVE-2026-9748 Medium 6.5 $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input 0.3%
• CVE-2026-9747 Medium 6.5 Crafted cross-shard merge aggregation crashes MongoDB Server 0.3%
• CVE-2026-9746 Medium 6.5 Server crashes in case of the use of exchange 0.3%
• CVE-2026-9743 Medium 6.5 Aggregation sub-pipeline null dereference may allow DoS via crafted getMore 0.3%
• CVE-2026-9742 High 7.5 Authenticate command with specific mechanism parameter can trigger server crash 0.3%
• CVE-2026-9741 Medium 6.5 Client side encryption fails to encrypt values in a $vectorSearch 0.1%
• CVE-2026-6915 Medium 6.3 Flaw in the updateUser Command May Allow Unauthorized Configuration Change 0.2%
• CVE-2026-6914 Medium 6.5 MD5 checksum creation may cause availability loss 0.3%
• CVE-2026-5170 Medium 5.3 Users could trigger a crash of mongod primaries during promotion to sharded 0.2%