MongoDB Inc vulnerabilities

CVEs per yearBy the year they were published

1. 20234
2. 202418
3. 202524
4. 202615

Newest CVEs

• CVE-2026-4359

  Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

  MongoDB Inc · MongoDB C Driver

  Low2.0
• CVE-2026-4358

  Memory safety issues in slot-based execution hash table spill

  MongoDB Inc · MongoDB Server

  Medium6.1
• CVE-2026-4148

  ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

  MongoDB Inc · MongoDB Server

  High8.7
• CVE-2026-4147

  Stack memory disclosure in filemd5 command

  MongoDB Inc · MongoDB Server

  High7.1
• CVE-2026-2303

  Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

  MongoDB Inc · MongoDB Go Driver

  Medium6.9
• CVE-2026-2302

  Unsafe Reflection in Mongoid::Criteria.from_hash

  MongoDB Inc · MongoDB Ruby Driver

  Medium6.9
• CVE-2026-25613

  An unsafe cast in the MongoDB query planner can result in a segmentation fault.

  MongoDB Inc · MongoDB Server

  High7.1
• CVE-2026-1849

  Mongod can run out of stack memory when expressions create deeply nested documents

  MongoDB Inc · MongoDB Server

  High7.1
• CVE-2026-1850

  An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

  MongoDB Inc · MongoDB Server

  High7.1
• CVE-2026-25609

  profile command may permit unauthorized configuration

  MongoDB Inc · MongoDB Server

  Medium5.3