MongoDB vulnerabilities
248 published CVEs name MongoDB among the affected products.
- 248Published CVEs248 of them scored
- 244Last 12 monthspublished in the last year
- 8Critical134 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126982
Remote code execution via generic-type allow-list bypass in BSON object deserialization
MongoDB · C# Driver
High7.7 - CVE-2026-126839
Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization
MongoDB · C# Driver
Low2.3 - CVE-2026-126792
Heap overflow via oversized RSA signature in GCP KMS signing callback
MongoDB · Libmongocrypt Driver
Medium5.6 - CVE-2026-126823
Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir
MongoDB · Atlas SQL JDBC Driver
High7.3 - CVE-2026-126838
Rust Driver public Client Debug output exposes CSFLE KMS master-key material
MongoDB · Rust Driver
Medium5.7 - CVE-2026-126835
[Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens
MongoDB · Node.js Driver
Medium5.9 - CVE-2026-126837
Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guard
MongoDB · Node.js Driver
Critical9.1 - CVE-2026-120819
Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator
MongoDB · MongoDB Server
Medium5.3 - CVE-2026-118383
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
MongoDB · MongoDB Server
Critical9.5 - CVE-2026-120828
Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage
MongoDB · MongoDB Server
High8.7