Total
188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-9743 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions. | |||||
| CVE-2026-9748 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod. | |||||
| CVE-2026-9752 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference. | |||||
| CVE-2026-9741 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext. | |||||
| CVE-2026-9753 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 8.1 HIGH |
| The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command. | |||||
| CVE-2026-9747 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | |||||
| CVE-2026-9749 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 6.5 MEDIUM |
| This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended. | |||||
| CVE-2026-11933 | 1 Mongodb | 1 Mongodb | 2026-06-22 | N/A | 8.8 HIGH |
| A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash. | |||||
| CVE-2026-5170 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 5.3 MEDIUM |
| A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31. | |||||
| CVE-2026-4358 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.4 MEDIUM |
| A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk. | |||||
| CVE-2026-4148 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 8.8 HIGH |
| A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline. | |||||
| CVE-2026-4147 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. | |||||
| CVE-2026-25613 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. | |||||
| CVE-2026-25610 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | |||||
| CVE-2026-25609 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 5.4 MEDIUM |
| Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. | |||||
| CVE-2026-1850 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. | |||||
| CVE-2026-1849 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression. | |||||
| CVE-2026-1848 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 7.5 HIGH |
| Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header. | |||||
| CVE-2026-1847 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash. | |||||
| CVE-2025-7259 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0. | |||||