Vulnerabilities in MongoDB Inc.

67 results
Vexday analysis

Com 53 CVEs catalogadas, o perfil de vulnerabilidades do MongoDB Inc. não apresenta falhas de severidade crítica, mas chama atenção pela taxa de exploração ativa: 1,89% das CVEs constam no catálogo CISA KEV, proporção 4,2 vezes acima da média geral do catálogo. A CVE-2025-14847 concentra o maior risco imediato, com EPSS de 0,83 — indicando alta probabilidade de exploração — e é a única entrada atualmente confirmada como explorada ativamente. O tipo de falha mais recorrente, CWE-20 (validação inadequada de entrada), sugere uma superfície de ataque que tende a ser amplamente explorada quando exposta. A chegada de 4 novas CVEs nos últimos 90 dias e a existência de prova de conceito pública para uma delas reforçam a necessidade de ciclos de remediação ágeis em ambientes que utilizam produtos dessa linha.

CVE-2021-20330MEDIUMSpecific replication command with malformed oplog entries can crash secondariesEPSS 1.0%CVE-2021-32036MEDIUMDenial of Service and Data Integrity vulnerability in features commandEPSS 1.0%CVE-2019-2390HIGHCode execution on Windows via OpenSSL engine injectionEPSS 1.0%CVE-2018-25004MEDIUMInvariant failure when explaining a find with a UUIDEPSS 1.0%CVE-2019-2388MEDIUMPotential exposure of log information in Ops ManagerEPSS 1.0%CVE-2021-20329MEDIUMSpecific cstrings input may not be properly validated in the Go DriverEPSS 1.0%CVE-2021-20326MEDIUMSpecially crafted query may result in a denial of service of mongodEPSS 0.9%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 0.9%CVE-2023-0342LOWMongoDB Ops Manager may disclose sensitive information in Diagnostic ArchiveEPSS 0.9%CVE-2019-2391MEDIUMJS-bson may incorrectly serialise some requestsEPSS 0.9%CVE-2023-4009HIGHPrivilege Escalation for Project Owner and Project User Admin Roles in Ops ManagerEPSS 0.8%CVE-2020-7924MEDIUMSpecific command line parameter might result in accepting invalid certificateEPSS 0.7%CVE-2020-7922MEDIUMKubernetes Operator generates potentially insecure certificatesEPSS 0.7%CVE-2020-7921MEDIUMAdministrative action may disable enforcement of per-user IP whitelistingEPSS 0.7%CVE-2021-20331MEDIUMMongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an applicationEPSS 0.6%CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-93393CRITICALHeap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamEPSS 0.5%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%