MongoDB MongoDB Server
95 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-104005 | 8.3.0 – < 8.3.13 ; 9.0 – < 9.0.4 | Incorrect authorization in MongoDB Server router for bulk writes to system namespaces | HIGH 7.1 | 0.2 % | ||
| CVE-2026-104004 | 8.3.0 – < 8.3.13 ; 8.0 – < 8.0.34 ; 9.0 – < 9.0.4 | Collection validators using collation-accepting expressions can crash MongoDB Server on insert | HIGH 7.1 | 0.2 % | ||
| CVE-2026-103965 | 8.3.0 – < 8.3.13 ; 8.0 – < 8.0.34 ; 7.0 – < 7.0.45 ; … | Fixed values in MongoDB Server $bucket stage may be misread as field references | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-96299 | 8.3.0 – < 8.3.13 ; 9.0 – < 9.0.4 | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service | HIGH 7.1 | 0.2 % | ||
| CVE-2026-96297 | 8.3.0 – < 8.3.13 ; 8.0 – < 8.0.34 ; 7.0 – < 7.0.45 ; … | MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-89099 | 8.3.0 – < 8.3.11 ; 8.0 – < 8.0.32 ; 7.0 – < 7.0.43 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption | HIGH 7.7 | 0.3 % | ||
| CVE-2026-82076 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82075 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2026-82074 | 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82073 | 8.3.0 – < 8.3.9 | Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82071 | 8.3.0 – < 8.3.9 | Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write | HIGH 7.2 | 0.5 % | ||
| CVE-2026-82070 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface | HIGH 7.1 | 0.3 % | ||
| CVE-2026-82069 | 8.3.0 – < 8.3.9 | Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router | MEDIUM 5.1 | 0.4 % | ||
| CVE-2026-82068 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82067 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-82066 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Heap Out-of-Bounds Read in MongoDB Server Query Planning Component | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-82065 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82064 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members | HIGH 8.7 | 0.5 % | ||
| CVE-2026-82063 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-82062 | 8.3.0 – < 8.3.9 | Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass | HIGH 7.0 | 0.5 % | ||
| CVE-2026-82061 | 8.3.0 – < 8.3.9 | Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service | HIGH 7.2 | 0.5 % | ||
| CVE-2026-82060 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups | LOW 2.3 | 0.3 % | ||
| CVE-2026-82059 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-82058 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82057 | 8.3.0 – < 8.3.9 | Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82056 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-82055 | 8.3.0 – < 8.3.9 | Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82054 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82053 | 8.3.0 – < 8.3.9 ; 8.0.0 – < 8.0.30 ; 7.0.0 – < 7.0.41 | Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment | HIGH 7.6 | 0.4 % | ||
| CVE-2026-82052 | 8.3.0 – < 8.3.9 ; 8.0 – < 8.0.30 ; 7.0 – < 7.0.41 | $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars | HIGH 7.1 | 0.5 % | ||
| CVE-2026-18712 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections | HIGH 7.2 | 0.2 % | ||
| CVE-2026-18711 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 | Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure | HIGH 7.1 | 0.5 % | ||
| CVE-2026-18709 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-18698 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-18690 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections | HIGH 7.2 | 0.4 % | ||
| CVE-2026-18699 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Input Validation in MongoDB Query Planner Leads to Denial of Service | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-18691 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-18702 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-18694 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure | HIGH 7.1 | 0.4 % | ||
| CVE-2026-18708 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-18696 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections | HIGH 7.0 | 0.4 % | ||
| CVE-2026-18700 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-18701 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Type Confusion in MongoDB Query Subsystem Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-18697 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos | HIGH 8.7 | 0.4 % | ||
| CVE-2026-18693 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure | HIGH 7.2 | 0.3 % | ||
| CVE-2026-18705 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data | HIGH 7.1 | 0.4 % | ||
| CVE-2026-18704 | 8.3.0 – < 8.3.8 | Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations | HIGH 7.1 | 0.3 % | ||
| CVE-2026-18692 | 8.3.0 – < 8.3.8 | Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution | HIGH 7.7 | 0.6 % | ||
| CVE-2026-18688 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure | HIGH 7.1 | 0.4 % | ||
| CVE-2026-18695 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 ; 7.0 – < 7.0.40 | Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-18687 | 8.3.0 – < 8.3.8 ; 8.0 – < 8.0.29 | Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption | HIGH 7.1 | 0.2 % | ||
| CVE-2026-18706 | 8.3.0 – < 8.3.8 | Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18707 | 8.3.0 – < 8.3.8 | Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-18703 | 8.3.0 – < 8.3.8 | Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method | LOW 2.3 | 0.1 % | ||
| CVE-2026-13055 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Server crash via aggregation pipeline expression with compound wildcard index specification | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13056 | 8.0 – < 8.0.28 ; 8.3.0 – < 8.3.7 | A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13057 | 8.0 – < 8.0.28 ; 8.3.0 – < 8.3.7 ; 8.2.0 – < 8.2.12 | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-13058 | 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; 8.3.0 – < 8.3.7 | Transaction Command Insufficient Input Validation Leading to Process Termination | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13059 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | HIGH 8.6 | 0.4 % | ||
| CVE-2026-9737 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Find command with $meta sort can lead to crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13060 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13061 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.3.0 – < 8.3.7 | Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-13062 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters | HIGH 7.1 | 0.2 % | ||
| CVE-2026-13063 | 8.2.0 – < 8.2.12 ; 8.3.0 – < 8.3.7 | libmongocrypt Improper Input Validation Leading to Process Termination | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-13064 | 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; 8.3.0 – < 8.3.7 | MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service | HIGH 7.1 | 0.5 % | ||
| CVE-2026-13065 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination | HIGH 7.1 | 0.5 % | ||
| CVE-2026-13066 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13067 | 8.0 – < 8.0.28 ; 8.3.0 – < 8.3.7 | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket | HIGH 7.2 | 0.1 % | ||
| CVE-2026-13068 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse | LOW 2.3 | 0.3 % | ||
| CVE-2026-13069 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion | HIGH 7.1 | 0.3 % | ||
| CVE-2026-13070 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-13071 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13072 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-13073 | 8.0 – < 8.0.28 | MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-13074 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-13075 | 8.2.0 – < 8.2.12 ; 8.3.0 – < 8.3.7 | $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13076 | 8.3.0 – < 8.3.7 | Aggregation Framework Memory Exhaustion Leading to Process Termination | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13077 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data | HIGH 7.1 | 0.4 % | ||
| CVE-2026-13078 | 7.0 – < 7.0.39 ; 8.0 – < 8.0.28 ; 8.2.0 – < 8.2.12 ; … | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-9740 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow | HIGH 8.7 | 0.3 % | ||
| CVE-2026-9735 | 8.3.0 – < 8.3.3 | Keyfile contents are in MongoDB Server logs | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-9753 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. | HIGH 7.2 | 0.3 % | ||
| CVE-2026-9752 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9751 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Sensitive data could be written to mongod.log | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-9750 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Metadata name collision on $-prefixed fields causes post-auth server crash | HIGH 7.1 | 0.4 % | ||
| CVE-2026-9749 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Using MaxKey() may crash the server | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9748 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.10 ; … | $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9747 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Crafted cross-shard merge aggregation crashes MongoDB Server | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9746 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Server crashes in case of the use of exchange | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9743 | 8.0.0 – < 8.0.24 | Aggregation sub-pipeline null dereference may allow DoS via crafted getMore | HIGH 7.1 | 0.3 % | ||
| CVE-2026-9742 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 | Authenticate command with specific mechanism parameter can trigger server crash | HIGH 8.2 | 0.3 % | ||
| CVE-2026-9741 | 8.3.0 – < 8.3.3 ; 8.2.0 – < 8.2.10 ; 8.0.0 – < 8.0.24 ; … | Client side encryption fails to encrypt values in a $vectorSearch | HIGH 7.1 | 0.1 % | ||
| CVE-2026-6915 | 8.2.0 – < 8.2.7 ; 8.0.0 – < 8.0.21 ; 7.0.0 – < 7.0.32 | Flaw in the updateUser Command May Allow Unauthorized Configuration Change | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-6914 | 8.2.0 – < 8.2.7 ; 8.1.0 – 8.1.* ; 8.0.0 – < 8.0.21 ; … | MD5 checksum creation may cause availability loss | HIGH 7.1 | 0.3 % | ||
| CVE-2026-5170 | 8.2 – < 8.2.2 ; 8.0 – < 8.0.18 ; 7.0 – < 7.0.31 | Users could trigger a crash of mongod primaries during promotion to sharded | MEDIUM 6.0 | 0.2 % |