Total
188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-8063 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.5 MEDIUM |
| An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server. This issue affects MongoDB Server 8.2 versions prior to 8.2.7. | |||||
| CVE-2026-6914 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.5 MEDIUM |
| Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32 | |||||
| CVE-2026-6915 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.3 MEDIUM |
| An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account. | |||||
| CVE-2026-8201 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.4 MEDIUM |
| A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8053 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 8.8 HIGH |
| An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8200 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 2.7 LOW |
| When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8336 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 7.5 HIGH |
| After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8202 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 4.3 MEDIUM |
| Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8199 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.5 MEDIUM |
| An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2. | |||||
| CVE-2026-8843 | 1 Mongodb | 1 Mongodb | 2026-10-26 | N/A | 6.5 MEDIUM |
| Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6 | |||||
| CVE-2026-13073 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options. | |||||
| CVE-2026-13059 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 8.1 HIGH |
| An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations. | |||||
| CVE-2026-13056 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.5 MEDIUM |
| Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error. | |||||
| CVE-2026-13064 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.5 MEDIUM |
| Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls. | |||||
| CVE-2026-13069 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.5 MEDIUM |
| An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations. | |||||
| CVE-2026-13061 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps. | |||||
| CVE-2026-13075 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.5 MEDIUM |
| An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | |||||
| CVE-2026-13068 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 4.2 MEDIUM |
| An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace. | |||||
| CVE-2026-13062 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.5 MEDIUM |
| An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness. | |||||
| CVE-2026-13067 | 1 Mongodb | 1 Mongodb | 2026-10-24 | N/A | 6.3 MEDIUM |
| When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority. | |||||