MongoDB vulnerabilities

CVEs per yearBy the year they were published

1. 20256
2. 2026209

Newest CVEs

• CVE-2026-120959

  MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes

  MongoDB · Atlas SQL

  Low2.1
• CVE-2026-120952

  MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write

  MongoDB · Atlas SQL ODBC Driver

  Medium6.0
• CVE-2026-120567

  ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions

  MongoDB · Entity Framework Core Provider

  Low2.3
• CVE-2026-120953

  Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

  MongoDB · Atlas SQL JDBC Driver

  Medium5.1
• CVE-2026-120954

  Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

  MongoDB · C Driver

  Medium6.3
• CVE-2026-120955

  MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

  MongoDB · C Driver

  High8.7
• CVE-2026-120956

  remote abort and memory disclosure from a malformed cursor.ns

  MongoDB · C Driver

  High7.1
• CVE-2026-120684

  MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

  MongoDB · C Driver

  Medium6.0
• CVE-2026-120678

  MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

  MongoDB · C Driver

  High8.7
• CVE-2026-120673

  Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

  MongoDB · Rust Driver

  Medium6.8