MongoDB Inc. vulnerabilities

CVEs per yearBy the year they were published

1. 20193
2. 202018
3. 202114
4. 20224
5. 20232
6. 20258
7. 202619

Known exploitedNewest addition to KEV first

• CVE-2025-14847

  Zlib compressed protocol header length confusion may allow memory read

  MongoDB Inc. · MongoDB Server

  ExploitedHigh8.7

Newest CVEs

• CVE-2026-112368

  Unbounded Recursion in phongo_bson_visit_document/visit_array:

  MongoDB Inc. · PHP Driver

  High8.2
• CVE-2026-93759

  Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

  MongoDB Inc. · Mongoid

  High8.8
• CVE-2026-93760

  NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

  MongoDB Inc. · Mongoid

  High8.3
• CVE-2026-93761

  Denial of service via unbounded regex matching in Mongoid's in-memory query matcher

  MongoDB Inc. · Mongoid

  High8.7
• CVE-2026-93762

  Data deletion and attribute disclosure via field-name method injection in in-memory queries

  MongoDB Inc. · Mongoid

  Critical9.2
• CVE-2026-93763

  Silent plaintext persistence via unresolved callable database name in encryption schema map

  MongoDB Inc. · Mongoid

  High7.1
• CVE-2026-93764

  Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

  MongoDB Inc. · Mongoid

  High7.1
• CVE-2026-93765

  Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

  MongoDB Inc. · Mongoid

  High8.3
• CVE-2026-93758

  Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

  MongoDB Inc. · Mongoid

  High8.6
• CVE-2026-93395

  Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

  MongoDB Inc. · C Driver

  Medium6.9