Total
188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-18690 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 8.1 HIGH |
| An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization. | |||||
| CVE-2026-18694 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.1 HIGH |
| An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory. | |||||
| CVE-2026-18688 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.1 HIGH |
| An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents. | |||||
| CVE-2026-18709 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.4 MEDIUM |
| An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees. | |||||
| CVE-2026-18706 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.6 MEDIUM |
| An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code. | |||||
| CVE-2026-18697 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.5 HIGH |
| An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance. | |||||
| CVE-2026-18704 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations. | |||||
| CVE-2026-18703 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 4.2 MEDIUM |
| An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable. | |||||
| CVE-2026-18696 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation. | |||||
| CVE-2026-18695 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service. | |||||
| CVE-2026-18702 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.4 MEDIUM |
| An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume. | |||||
| CVE-2026-18700 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service. | |||||
| CVE-2026-18701 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service. | |||||
| CVE-2026-18687 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.1 HIGH |
| MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data. | |||||
| CVE-2026-18693 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.6 HIGH |
| An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption. | |||||
| CVE-2025-12657 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 5.0 MEDIUM |
| The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations. | |||||
| CVE-2025-12893 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 4.2 MEDIUM |
| Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2 | |||||
| CVE-2025-13507 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 6.5 MEDIUM |
| Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1. | |||||
| CVE-2025-13644 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 6.5 MEDIUM |
| MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2 | |||||
| CVE-2025-13643 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 3.1 LOW |
| A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14 | |||||