CVEs published by MongoDB, Inc.

CVEs published by MongoDB, Inc. (CVE Numbering Authority). 42 tracked.

CVE-2026-115929 MEDIUM 6.8 MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store
CVE-2026-18692 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr
CVE-2026-18697 HIGH 7.5 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (rou
CVE-2026-18691 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access t
CVE-2026-18690 HIGH 8.1 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
CVE-2026-18688 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-boun
CVE-2026-18693 HIGH 7.6 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write p
CVE-2026-18694 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileg
CVE-2026-18706 MEDIUM 6.6 UPGRADE DOWNGRADE An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue ag
CVE-2026-18695 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaF
CVE-2026-18696 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default priv
CVE-2026-18699 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cau
CVE-2026-18700 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to
CVE-2026-18701 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause t
CVE-2026-18705 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to
CVE-2026-18687 HIGH 7.1 UPGRADE DOWNGRADE MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain re
CVE-2026-18702 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modif
CVE-2026-18704 MEDIUM 6.5 UPGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges
CVE-2026-18709 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improper
CVE-2026-18698 MEDIUM 5.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
CVE-2026-18703 MEDIUM 4.2 UPGRADE DOWNGRADE An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user accoun
CVE-2026-18710 MEDIUM 6.5 UPGRADE A MongoDB driver component could write sensitive configuration information, including a credential used for ou
CVE-2026-114644 MEDIUM 5.9 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserializa
CVE-2026-114654 MEDIUM 6.5 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range bi
CVE-2026-114648 HIGH 7.6 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-
CVE-2026-114646 MEDIUM 6.5 A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver
CVE-2026-114655 MEDIUM 5.9 libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values fro
CVE-2026-114652 MEDIUM 6.5 A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Dr
CVE-2026-114651 MEDIUM 4.0 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left
CVE-2026-114653 MEDIUM 6.5 A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field i
CVE-2026-114643 MEDIUM 5.4 The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved
CVE-2026-114649 MEDIUM 6.8 The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether
CVE-2026-114650 MEDIUM 5.9 A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for clien
CVE-2026-114645 MEDIUM 5.2 A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause
CVE-2026-114647 MEDIUM 4.3 The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar si
CVE-2026-19001 CRITICAL 9.8 UPGRADE The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s
CVE-2026-19004 HIGH 8.1 UPGRADE An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing
CVE-2026-19002 HIGH 8.1 UPGRADE A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Drive
CVE-2026-19003 HIGH 7.8 UPGRADE A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC D
CVE-2026-18888 MEDIUM 6.5 UPGRADE The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the
CVE-2026-19502 MEDIUM 5.5 UPGRADE MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is
CVE-2026-113870 HIGH 8.8 MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline in

← Back to latest CVEs