Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Incorrect authorization in MongoDB Server router for bulk writes to system namespacesEPSS 0.2%Oct 13, 2026
- High7.1Collection validators using collation-accepting expressions can crash MongoDB Server on insertEPSS 0.2%Oct 13, 2026
- Medium6.9An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting.Oct 9, 2026
- Medium6.0An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's…Oct 9, 2026
- Low2.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the r…Oct 9, 2026
- Medium5.9The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element w…EPSS 0.1%Oct 8, 2026
- Medium5.3Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior le…May 20, 2026
- Medium6.0The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.May 20, 2026
- High7.1Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that ind…May 18, 2026
- Medium6.0Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the s…May 14, 2026
- High7.5Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.May 14, 2026
- High7.7After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subse…May 13, 2026
- Medium5.3Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation pe…May 13, 2026
- Medium6.1A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared.May 13, 2026
- Medium4.8When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have al…May 13, 2026
- High7.1An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.May 13, 2026
- High8.7An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write…May 13, 2026
- Critical9.4An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.May 12, 2026
- High7.1An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.May 7, 2026
- High8.6The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authenticatio…May 6, 2026
- Medium5.3An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account.Apr 29, 2026
- High7.1Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.Apr 29, 2026
- Medium5.3The bson_validate function may return early on specific inputs and incorrectly report success.Apr 13, 2026
- Medium6.0A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the…Mar 30, 2026
- Low2.0A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.Mar 17, 2026
31 records · page 1 of 2
PreviousNext