Vulnerabilidades em MongoDB Inc.

67 resultados
Análise Vexday

Com 53 CVEs catalogadas, o perfil de vulnerabilidades do MongoDB Inc. não apresenta falhas de severidade crítica, mas chama atenção pela taxa de exploração ativa: 1,89% das CVEs constam no catálogo CISA KEV, proporção 4,2 vezes acima da média geral do catálogo. A CVE-2025-14847 concentra o maior risco imediato, com EPSS de 0,83 — indicando alta probabilidade de exploração — e é a única entrada atualmente confirmada como explorada ativamente. O tipo de falha mais recorrente, CWE-20 (validação inadequada de entrada), sugere uma superfície de ataque que tende a ser amplamente explorada quando exposta. A chegada de 4 novas CVEs nos últimos 90 dias e a existência de prova de conceito pública para uma delas reforçam a necessidade de ciclos de remediação ágeis em ambientes que utilizam produtos dessa linha.

CVE-2021-20332MEDIUMMongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an applicationEPSS 0.3%CVE-2019-2389MEDIUMProcess termination via PID file manipulationEPSS 0.3%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.3%CVE-2025-13507HIGHTime-series operations may cause internal BSON size limit to be exceedEPSS 0.3%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.3%CVE-2026-93393CRITICALHeap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamEPSS 0.3%CVE-2021-32039MEDIUMMongoDB Extension for VS Code may unexpectedly store credentials locally in clear textEPSS 0.3%CVE-2025-11979MEDIUMUse-after-free in the MongoDB server query planner may lead to crash or undefined behaviorEPSS 0.3%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.3%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.2%CVE-2026-93395MEDIUMInteger Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()EPSS 0.2%CVE-2026-8063HIGHPost-auth null pointer dereference when aggregating against a view with empty search pipelineEPSS 0.2%CVE-2025-13643LOWMongoDB Server may allow queries to be terminated by unauthorized usersEPSS 0.2%CVE-2025-14345LOWCross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerEPSS 0.2%CVE-2026-93758HIGHCross-principal document update, theft, and deletion via unvalidated id in nested attributesEPSS 0.2%CVE-2021-20327MEDIUMMongoDB Node.js client side field level encryption library may not be validating KMS certificateEPSS 0.2%CVE-2021-20334MEDIUMLocal privilege escalation in MongoDB Compass for WindowsEPSS 0.2%CVE-2026-93394MEDIUMlibmongoc SCRAM client nonce-validation bypassEPSS 0.2%CVE-2026-6231MEDIUMbson_validate may skip validation when processing certain inputsEPSS 0.2%CVE-2021-20335MEDIUMSSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops ManagerEPSS 0.1%