Vulnerabilities in MongoDB
215 resultsCVE-2026-106430MEDIUMQuery and rename target confusion via embedded NUL truncation in MongoDB C++ DriverEPSS 0.2%CVE-2025-11695HIGHConfiguration may unexpectedly disable certificate validationEPSS 0.2%CVE-2026-119675MEDIUMmongorestore may bypass collection guards through a system.buckets prefixEPSS 0.2%CVE-2026-106432LOWHeap buffer overflow via 32-bit string-length truncation in MongoDB PHP DriverEPSS 0.2%CVE-2026-6915MEDIUMFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeEPSS 0.2%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.2%CVE-2026-114645MEDIUMHeap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingEPSS 0.2%CVE-2026-119674LOWmongorestore may restore encoded collection names into an unintended collectionEPSS 0.2%CVE-2026-120567LOWEF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field referenceEPSS 0.1%CVE-2026-103965MEDIUMFixed values in MongoDB Server $bucket stage may be misread as field referencesEPSS 0.1%CVE-2026-119673LOWmongofiles may write outside the working directory through a symlinkEPSS 0.1%CVE-2026-18710HIGHCleartext Storage of Sensitive Information in MongoDB Driver Logging During Client InitializationEPSS 0.1%CVE-2026-18703LOWImproper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication MethodEPSS 0.1%CVE-2026-116641HIGHThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2026-84966MEDIUMBSON element injection via NUL-embedded document keys in builder appendEPSS 0.1%CVE-2026-87108LOWOps Manager Improper Authorization in Daily Host Monitoring RetrievalEPSS 0.1%CVE-2026-106438MEDIUMSilent Decimal128 value corruption via incorrect exactness check in MongoDB C DriverEPSS 0.1%CVE-2025-11575HIGHMongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2026-106437MEDIUMOut-of-bounds read and write via undersized BSON buffer reservation in MongoDB C DriverEPSS 0.1%CVE-2026-13070MEDIUMImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationEPSS 0.1%