Vulnerabilidades em MongoDB
215 resultadosAnálise Vexday
MongoDB apresenta 23 vulnerabilidades catalogadas, com concentração recente de 17 divulgações nos últimos 90 dias, indicando atividade elevada de descoberta de falhas. Nenhuma das vulnerabilidades está sob ataque ativo (KEV) e não há críticas de CVSS, reduzindo o risco imediato, mas a fraqueza dominante em autenticação/autorização (CWE-617) merece monitoramento contínuo em ambientes de produção.
CVE-2026-18706HIGHUse-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code ExecutionEPSS 0.5%CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2026-81517HIGHMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceEPSS 0.5%CVE-2026-88033MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverEPSS 0.5%CVE-2026-88034MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverEPSS 0.5%CVE-2026-82062HIGHImproper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate BypassEPSS 0.5%CVE-2026-13064HIGHMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceEPSS 0.5%CVE-2026-13074MEDIUMAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceEPSS 0.4%CVE-2026-18697HIGHImproper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongosEPSS 0.4%CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.4%CVE-2026-13060HIGH$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection AccessEPSS 0.4%CVE-2026-114643MEDIUMDuplicate geometry fields via unvalidated GeoJSON extra membersEPSS 0.4%CVE-2026-77586HIGHMongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputEPSS 0.4%CVE-2026-13077HIGHOut-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataEPSS 0.4%CVE-2026-88028HIGHUnauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for LaravelEPSS 0.4%CVE-2026-13071HIGHServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationEPSS 0.4%CVE-2026-18888HIGHMongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character dataEPSS 0.4%CVE-2026-9737HIGHFind command with $meta sort can lead to crashEPSS 0.4%CVE-2026-13075HIGH$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationEPSS 0.4%CVE-2026-82057HIGHType Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceEPSS 0.4%