CVE Tools
Track your stack

Mongodb

211 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Mongodb, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Mongodb CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Mongodb CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-020
2025-032
2025-044
2025-050
2025-064
2025-075
2025-080
2025-094
2025-103
2025-115
2025-122
2026-010
2026-029
2026-035
2026-042
2026-058
2026-0615
2026-0725
2026-0824
2026-0926
2026-106

Severity

How the 211 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical42%
  • High5325%
  • Medium14871%
  • Low42%

Latest CVEs

The 15 most recently published vulnerabilities affecting Mongodb.

  1. CVE-2026-104005Incorrect authorization in MongoDB Server router for bulk writes to system namespaces6.5
  2. CVE-2026-104004Collection validators using collation-accepting expressions can crash MongoDB Server on insert6.5
  3. CVE-2026-103965Fixed values in MongoDB Server $bucket stage may be misread as field references5.4
  4. CVE-2026-96299Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service6.5
  5. CVE-2026-96297MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline6.5
  6. CVE-2026-106119LangChain: MongoDBChatMessageHistory query injection can allow cross-session access—
  7. CVE-2026-89099Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption7.5
  8. CVE-2026-82076Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server6.5
  9. CVE-2026-82075Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service7.5
  10. CVE-2026-82074Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data6.5
  11. CVE-2026-82073Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search6.5
  12. CVE-2026-82071Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write8.1
  13. CVE-2026-82069Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router2.7
  14. CVE-2026-82070Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface6.5
  15. CVE-2026-82068Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service6.5

Product grouping is registry-driven, with AI assist and human review. How it works