Filtered by vendor Mongodb
Subscribe
Total
312 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-18702 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.4 MEDIUM |
| An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume. | |||||
| CVE-2026-18700 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service. | |||||
| CVE-2026-18701 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 6.5 MEDIUM |
| An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service. | |||||
| CVE-2026-18687 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.1 HIGH |
| MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data. | |||||
| CVE-2026-18693 | 1 Mongodb | 1 Mongodb | 2026-10-23 | N/A | 7.6 HIGH |
| An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption. | |||||
| CVE-2026-18710 | 1 Mongodb | 1 Java Driver | 2026-10-23 | N/A | 6.5 MEDIUM |
| A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only. | |||||
| CVE-2026-18888 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 6.5 MEDIUM |
| The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read. | |||||
| CVE-2026-19003 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 7.8 HIGH |
| A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog. | |||||
| CVE-2026-19002 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 8.1 HIGH |
| A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code. | |||||
| CVE-2026-19502 | 1 Mongodb | 1 Sql Schema Builder Cli | 2026-10-23 | N/A | 5.5 MEDIUM |
| MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values. | |||||
| CVE-2026-19001 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 9.8 CRITICAL |
| The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution. | |||||
| CVE-2026-19004 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-10-23 | N/A | 8.1 HIGH |
| An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution. | |||||
| CVE-2025-12657 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 5.0 MEDIUM |
| The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations. | |||||
| CVE-2025-12893 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 4.2 MEDIUM |
| Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2 | |||||
| CVE-2025-13507 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 6.5 MEDIUM |
| Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1. | |||||
| CVE-2025-13644 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 6.5 MEDIUM |
| MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2 | |||||
| CVE-2025-13643 | 1 Mongodb | 1 Mongodb | 2026-10-18 | N/A | 3.1 LOW |
| A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14 | |||||
| CVE-2026-87108 | 1 Mongodb | 1 Ops Manager | 2026-10-15 | N/A | 3.1 LOW |
| An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details. | |||||
| CVE-2026-87109 | 1 Mongodb | 1 Ops Manager | 2026-10-15 | N/A | 5.3 MEDIUM |
| An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. | |||||
| CVE-2026-87110 | 1 Mongodb | 1 Ops Manager | 2026-10-15 | N/A | 5.3 MEDIUM |
| An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue. | |||||