Vulnerabilidades em MongoDB
215 resultadosAnálise Vexday
MongoDB apresenta 23 vulnerabilidades catalogadas, com concentração recente de 17 divulgações nos últimos 90 dias, indicando atividade elevada de descoberta de falhas. Nenhuma das vulnerabilidades está sob ataque ativo (KEV) e não há críticas de CVSS, reduzindo o risco imediato, mas a fraqueza dominante em autenticação/autorização (CWE-617) merece monitoramento contínuo em ambientes de produção.
CVE-2026-106430MEDIUMQuery and rename target confusion via embedded NUL truncation in MongoDB C++ DriverEPSS 0.2%CVE-2025-11695HIGHConfiguration may unexpectedly disable certificate validationEPSS 0.2%CVE-2026-119675MEDIUMmongorestore may bypass collection guards through a system.buckets prefixEPSS 0.2%CVE-2026-106432LOWHeap buffer overflow via 32-bit string-length truncation in MongoDB PHP DriverEPSS 0.2%CVE-2026-6915MEDIUMFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeEPSS 0.2%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.2%CVE-2026-114645MEDIUMHeap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingEPSS 0.2%CVE-2026-119674LOWmongorestore may restore encoded collection names into an unintended collectionEPSS 0.2%CVE-2026-120567LOWEF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field referenceEPSS 0.1%CVE-2026-103965MEDIUMFixed values in MongoDB Server $bucket stage may be misread as field referencesEPSS 0.1%CVE-2026-119673LOWmongofiles may write outside the working directory through a symlinkEPSS 0.1%CVE-2026-18710HIGHCleartext Storage of Sensitive Information in MongoDB Driver Logging During Client InitializationEPSS 0.1%CVE-2026-18703LOWImproper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication MethodEPSS 0.1%CVE-2026-116641HIGHThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2026-84966MEDIUMBSON element injection via NUL-embedded document keys in builder appendEPSS 0.1%CVE-2026-87108LOWOps Manager Improper Authorization in Daily Host Monitoring RetrievalEPSS 0.1%CVE-2026-106438MEDIUMSilent Decimal128 value corruption via incorrect exactness check in MongoDB C DriverEPSS 0.1%CVE-2025-11575HIGHMongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2026-106437MEDIUMOut-of-bounds read and write via undersized BSON buffer reservation in MongoDB C DriverEPSS 0.1%CVE-2026-13070MEDIUMImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationEPSS 0.1%