Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,623All CVEsplus 18,890 rejected
- 386Last 24 hours2,975 in the last 7 days
- 17,114Last 30 days1,581 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 139 | 99 | 12 | 0 | 257 | 356 |
| 2025 | 0 | 18 | 13 | 5 | 0 | 36 | 99 |
| 2024 | 0 | 5 | 12 | 1 | 0 | 18 | 63 |
| 2023 | 0 | 1 | 4 | 1 | 0 | 6 | 45 |
| 2022 | 0 | 0 | 4 | 0 | 0 | 4 | 39 |
| 2021 | 0 | 0 | 14 | 0 | 0 | 14 | 35 |
| 2020 | 0 | 3 | 15 | 0 | 0 | 18 | 21 |
| 2019 | 0 | 2 | 1 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-120959 | MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writesMongoDB · Atlas SQL | Low2.1 |
| CVE-2026-120952 | MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds writeMongoDB · Atlas SQL ODBC Driver | Medium6.0 |
| CVE-2026-120567 | EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field referenceMongoDB · Entity Framework Core Provider | Low2.3 |
| CVE-2026-120953 | Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handlerMongoDB · Atlas SQL JDBC Driver | Medium5.1 |
| CVE-2026-120954 | Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector viewsMongoDB · C Driver | Medium6.3 |
| CVE-2026-120955 | MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataMongoDB · C Driver | High8.7 |
| CVE-2026-120956 | remote abort and memory disclosure from a malformed cursor.nsMongoDB · C Driver | High7.1 |
| CVE-2026-120684 | MongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordMongoDB · C Driver | Medium6.0 |
| CVE-2026-120678 | MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)MongoDB · C Driver | High8.7 |
| CVE-2026-120673 | Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the commandMongoDB · Rust Driver | Medium6.8 |
| CVE-2026-119674 | mongorestore may restore encoded collection names into an unintended collectionMongoDB · Database Tools | Low2.1 |
| CVE-2026-119673 | mongofiles may write outside the working directory through a symlinkMongoDB · Database Tools | Low1.0 |
| CVE-2026-119672 | mongofiles may disclose GridFS content to standard output through a stored filenameMongoDB · Database Tools | Medium5.9 |
| CVE-2026-119675 | mongorestore may bypass collection guards through a system.buckets prefixMongoDB · Database Tools | Medium5.2 |
| CVE-2026-119179 | MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's dataMongoDB · Node.js Driver | High8.3 |
| CVE-2026-116641 | The DB Tools trust certificates issued by recoverable eMudhra intermediate CAsMongoDB · Database Tools | High7.6 |
| CVE-2026-118581 | NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocolMongoDB · Java Driver | Medium6.9 |
| CVE-2026-118510 | Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDsMongoDB · Laravel MongoDB | High7.7 |
| CVE-2026-115930 | MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAsMongoDB, Inc. · mongosh | High7.6 |
| CVE-2026-115929 | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAsMongoDB, Inc. · Compass | High7.6 |
| CVE-2026-114655 | KMS request injection via unsanitized key vault and provider values in libmongocryptMongoDB · libmongocrypt | Medium6.0 |
| CVE-2026-114654 | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guardsMongoDB · C# Driver | Medium6.9 |
| CVE-2026-114653 | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderMongoDB · C# Driver | High7.1 |
| CVE-2026-114652 | Update operator injection via single-element list rewriting in the update builderMongoDB · C# Driver | High7.1 |
| CVE-2026-114651 | Cross-document data leak via malformed BSON array parsing in reused thread bufferMongoDB · C# Driver | Medium6.3 |
| CVE-2026-114650 | Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameMongoDB · C# Driver | Medium6.9 |
| CVE-2026-114649 | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheMongoDB · C# Driver | High7.6 |
| CVE-2026-114648 | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keysMongoDB · C# Driver | High7.2 |
| CVE-2026-114647 | NoSQL operator injection via unvalidated replacement document in findOneAndReplaceMongoDB · C# Driver | Medium5.3 |
| CVE-2026-114646 | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireMongoDB · C# Driver | Medium6.9 |
| CVE-2026-114645 | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingMongoDB · C Driver | Medium5.7 |
| CVE-2026-114644 | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserializationMongoDB · C# Driver | High8.2 |
| CVE-2026-114643 | Duplicate geometry fields via unvalidated GeoJSON extra membersMongoDB · C# Driver | Medium5.3 |
| CVE-2026-113870 | Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON ParsingMongoDB · Compass | High8.6 |
| CVE-2026-112368 | Unbounded Recursion in phongo_bson_visit_document/visit_array:MongoDB Inc. · PHP Driver | High8.2 |
| CVE-2026-104005 | Incorrect authorization in MongoDB Server router for bulk writes to system namespacesMongoDB · MongoDB Server | High7.1 |
| CVE-2026-104004 | Collection validators using collation-accepting expressions can crash MongoDB Server on insertMongoDB · MongoDB Server | High7.1 |
| CVE-2026-103965 | Fixed values in MongoDB Server $bucket stage may be misread as field referencesMongoDB · MongoDB Server | Medium5.3 |
| CVE-2026-96299 | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of ServiceMongoDB · MongoDB Server | High7.1 |
| CVE-2026-96297 | MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipelineMongoDB · MongoDB Server | Medium6.0 |
| CVE-2026-87109 | Ops Manager Sensitive MFA Enrollment Information Exposure in User ListingsMongoDB · Ops Manager | Medium6.0 |
| CVE-2026-87108 | Ops Manager Improper Authorization in Daily Host Monitoring RetrievalMongoDB · Ops Manager | Low2.3 |
| CVE-2026-87110 | Ops Manager Uncontrolled Resource Consumption in Monitoring EndpointsMongoDB · Ops Manager | Medium6.9 |
| CVE-2026-106435 | Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python DriverMongoDB · Python Driver | Medium5.9 |
| CVE-2026-106436 | Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP DriverMongoDB · PHP Driver | Medium6.3 |
| CVE-2026-106432 | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP DriverMongoDB · PHP Driver | Low2.0 |
| CVE-2026-107325 | Application denial of service via missing BSON array length validation in MongoDB Go DriverMongoDB · Go Driver | High8.2 |
| CVE-2026-107324 | Application denial of service via integer overflow in BSON value-length validation in MongoDB Go DriverMongoDB · Go Driver | High8.2 |
| CVE-2026-106434 | Unrecognized payload acceptance in explicit decryption in MongoDB libmongocryptMongoDB · libmongocrypt | Medium5.3 |
| CVE-2026-106433 | Heap corruption via duplicate masterKey fields in MongoDB libmongocryptMongoDB · libmongocrypt | High8.7 |