Vulnerabilidades en MongoDB
215 resultadosCVE-2026-96750HIGHShell script injection via server-supplied database name in Open MongoDB shellEPSS 0.2%CVE-2026-87109MEDIUMOps Manager Sensitive MFA Enrollment Information Exposure in User ListingsEPSS 0.2%CVE-2026-119672MEDIUMmongofiles may disclose GridFS content to standard output through a stored filenameEPSS 0.2%CVE-2026-120959LOWMongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writesEPSS 0.2%CVE-2026-9754HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-114653HIGHSilent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderEPSS 0.2%CVE-2026-14881HIGHCompass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flowEPSS 0.2%CVE-2025-12119MEDIUMBulk write with options may read invalid memoryEPSS 0.2%CVE-2026-19003HIGHMongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settingsEPSS 0.2%CVE-2026-5170MEDIUMUsers could trigger a crash of mongod primaries during promotion to shardedEPSS 0.2%CVE-2026-19503MEDIUMInsufficient OIDC endpoint validation could invoke unintended local protocol handlersEPSS 0.2%CVE-2026-114649HIGHAuthentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheEPSS 0.2%CVE-2026-84968MEDIUMHeap out-of-bounds read via corrupt nested BSON in field path error messageEPSS 0.2%CVE-2026-18709MEDIUMMissing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data InconsistencyEPSS 0.2%CVE-2026-118581MEDIUMNoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocolEPSS 0.2%CVE-2026-96747MEDIUMForced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionEPSS 0.2%CVE-2026-13062HIGHMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersEPSS 0.2%CVE-2026-96749HIGHHeap out-of-bounds write via signed size overflow in BSON document encodingEPSS 0.2%CVE-2026-84962MEDIUMAuthenticated KMS request forgery via CRLF injection in GCP key identifier stringsEPSS 0.2%CVE-2026-19502MEDIUMInsufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLIEPSS 0.2%