MongoDB

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 7.5HighDec 29, 2025MongoDB and MongoDB ServerCVE-2025-14847MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.Added to KEV Dec 29, 2025Exploited83% likelyExploit codeMetasploit · NucleiDetection
• 9.9CriticalDec 24, 2019MongoDB mongo-express Code / command injectionCVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.Added to KEV Dec 10, 2021 · 716 days after publicationExploited85% likelyExploit codeNucleiDetection

Recent

• 6.8MediumOct 28, 2026MongoDB Database Tools Crypto / certificateCVE-2026-116641The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
• 6.8MediumOct 24, 2026MongoDB Compass Crypto / certificateCVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
• –UnscoredOct 23, 2026MongoDBADV-cccs-26f22aa92c16Serial number: AV26-1078 Date: October 22, 2026 As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product: C# Driver Prior to 3.13.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
• 6.8MediumOct 22, 2026MongoDB C# DriverCVE-2026-114649The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affect
• 7.6HighOct 22, 2026MongoDB C# Driver SQL injectionCVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents
• 4.3MediumOct 22, 2026MongoDB C# Driver SQL injectionCVE-2026-114647The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
• 6.5MediumOct 22, 2026MongoDB C# DriverCVE-2026-114646A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to
• 5.2MediumOct 22, 2026MongoDB C Driver Memory corruptionCVE-2026-114645A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and den
• 5.9MediumOct 22, 2026MongoDB C# Driver Denial of serviceCVE-2026-114644The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denyi
• 5.4MediumOct 22, 2026MongoDB C# DriverCVE-2026-114643The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.
• 5.9MediumOct 8, 2026Mongodb go driver Memory corruptionCVE-2026-107325Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.
• 5.9MediumOct 8, 2026Mongodb go driver Memory corruptionCVE-2026-107324An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.
• 4.0MediumOct 8, 2026Mongodb c driverCVE-2026-106438An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.
• 6.2MediumOct 8, 2026Mongodb c driver Memory corruptionCVE-2026-106437The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer a
• 8.8HighOct 8, 2026Mongodb libmongocrypt Memory corruptionCVE-2026-106433Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.
• 6.5MediumMay 18, 2026mongodbCVE-2026-8843Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
• 7.5HighDec 29, 2025MongoDB and MongoDB ServerCVE-2025-14847MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.Exploited83% likelyExploit codeMetasploit · NucleiDetection
• 9.9CriticalDec 24, 2019MongoDB mongo-express Code / command injectionCVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.Exploited85% likelyExploit codeNucleiDetection

See every MongoDB entry on the dashboard.

Top products

• C# Driver6 CVEs in the last year
• C Driver3 CVEs in the last year
• go driver2 CVEs in the last year
• MongoDB and MongoDB Server1 CVE in the last year, 1 exploited
• mongodb1 CVE in the last year
• libmongocrypt1 CVE in the last year
• Database Tools1 CVE in the last year
• Compass1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 23, 2026MongoDB security advisory (AV26-1078)ADV-cccs-26f22aa92c16