MongoDB MongoDB Server vulnerabilities

Newest CVEs

• CVE-2026-104005

  Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

  MongoDB · MongoDB Server

  High7.1
• CVE-2026-104004

  Collection validators using collation-accepting expressions can crash MongoDB Server on insert

  MongoDB · MongoDB Server

  High7.1
• CVE-2026-103965

  Fixed values in MongoDB Server $bucket stage may be misread as field references

  MongoDB · MongoDB Server

  Medium5.3
• CVE-2026-96299

  Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

  MongoDB · MongoDB Server

  High7.1
• CVE-2026-96297

  MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

  MongoDB · MongoDB Server

  Medium6.0
• CVE-2026-89099

  Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

  MongoDB · MongoDB Server

  High7.7
• CVE-2026-82076

  Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

  MongoDB · MongoDB Server

  High7.1
• CVE-2026-82075

  Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

  MongoDB · MongoDB Server

  High8.7
• CVE-2026-82074

  Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

  MongoDB · MongoDB Server

  High7.1
• CVE-2026-82073

  Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

  MongoDB · MongoDB Server

  High7.1