Vulnerabilidades en MongoDB
215 resultadosCVE-2026-13061MEDIUMImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation StageEPSS 0.3%CVE-2026-18702MEDIUMImproper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic SettingsEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%CVE-2026-9752HIGHGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationEPSS 0.3%CVE-2026-9746HIGHServer crashes in case of the use of exchangeEPSS 0.3%CVE-2026-9747HIGHCrafted cross-shard merge aggregation crashes MongoDB ServerEPSS 0.3%CVE-2026-9749HIGHUsing MaxKey() may crash the serverEPSS 0.3%CVE-2026-88027HIGHMass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for LaravelEPSS 0.3%CVE-2026-81524MEDIUMCross-tenant database retargeting via dot/NUL injection in namespace strings in the C DriverEPSS 0.3%CVE-2026-84967MEDIUMArbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminalEPSS 0.3%CVE-2026-114655MEDIUMKMS request injection via unsanitized key vault and provider values in libmongocryptEPSS 0.3%CVE-2026-88036MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C DriverEPSS 0.3%CVE-2026-88030MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby DriverEPSS 0.3%CVE-2026-88029MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python DriverEPSS 0.3%CVE-2026-114646MEDIUMNoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireEPSS 0.3%CVE-2026-106433HIGHHeap corruption via duplicate masterKey fields in MongoDB libmongocryptEPSS 0.3%CVE-2026-84971HIGHPersistent client crash loop via undersized FLE2 insert-update ciphertext in decryption pathEPSS 0.3%CVE-2026-84964HIGHHeap corruption via OCSP request double free from crafted multi-URL certificate in TLS clientEPSS 0.3%CVE-2026-88032HIGHApplication denial of service via cancellation race in reactive client-side encryption in MongoDB Java DriverEPSS 0.3%CVE-2026-106436MEDIUMApplication denial of service and data truncation via unchecked BSON append failures in MongoDB PHP DriverEPSS 0.3%