MongoDB Inc

Products

Exploited and recent CVEs

• CVE-2025-14847 High 7.5 Exploited Zlib compressed protocol header length confusion may allow memory read 83.2%
• CVE-2026-115930 Medium 6.8 MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs 0.1%
• CVE-2026-115929 Medium 6.8 MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs 0.2%
• CVE-2026-112368 High 7.5 Unbounded Recursion in phongo_bson_visit_document/visit_array: 0.3%
• CVE-2026-103546 Medium 4.3 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator 0.2%
• CVE-2026-93759 High 8.6 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist 0.4%
• CVE-2026-93760 High 8.2 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard 0.5%
• CVE-2026-93761 High 7.5 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher 0.5%
• CVE-2026-93762 Critical 9.8 Data deletion and attribute disclosure via field-name method injection in in-memory queries 0.6%
• CVE-2026-93763 Medium 6.5 Silent plaintext persistence via unresolved callable database name in encryption schema map 0.2%
• CVE-2026-93764 Medium 6.5 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation 0.1%
• CVE-2026-93765 Critical 9.1 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation 0.5%
• CVE-2026-93758 High 8.1 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes 0.4%
• CVE-2026-93395 Medium 5.3 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() 0.4%
• CVE-2026-93394 Low 3.7 libmongoc SCRAM client nonce-validation bypass 0.3%
• CVE-2026-93393 High 8.1 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream 0.5%
• CVE-2026-92757 Medium 5.5 Malformed connection string may disable field level encryption <0.1%
• CVE-2026-92758 Medium 5.5 Logs may collect sensitive information 0.2%
• CVE-2026-92756 Medium 5.5 Combining encryption settings may disable encryption <0.1%
• CVE-2026-9101 Medium 4.3 Prototype pollution in csv parsing 0.4%
• CVE-2026-9100 Medium 5.9 Heap memory out of bounds read and crash in C Driver legacy GridFS file reader 0.3%
• CVE-2026-8843 Medium 6.5 Calling createIndex with certain index types can crash mongod 0.2%
• CVE-2026-6811 Medium 5.9 PHP Stack Exhaustion 0.4%
• CVE-2026-8202 Medium 4.3 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators 0.3%
• CVE-2026-8336 High 7.5 Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands 0.3%
• CVE-2026-8201 Medium 6.4 Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields 0.1%
• CVE-2026-8200 Low 2.7 Schema validation log messages may not redact user data 0.2%
• CVE-2026-8199 Medium 6.5 Post-auth memory exhaustion via bitwise match expressions 0.3%
• CVE-2026-8053 High 8.8 FlatBSON Duplicate Field Index Drift 0.7%
• CVE-2026-8431 High 7.2 Ops Manager RCE via webhook body 0.4%