mongodb has 193 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 178 in the last 90 days against 9 in the 90 before. The busiest recent month was September 2026 with 72. The median CVSS is 6.5 (medium), with 3 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-943 (25) and CWE-617 (14). Most affected products: mongodb (55), c_driver (12), C# Driver (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 178 prev 9
Weakness classes
Products
- mongodb 55
- c_driver 12
- C# Driver 11
- bi_connector 8
- mongoid 8
- C Driver 7
Worst active — by depth score
CVE-2026-114648High· 7.6NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys54CVE-2026-93762Critical· 9.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents54CVE-2026-19001Critical· 9.8The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function54CVE-2026-93765Critical· 9.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code50CVE-2026-114649Medium· 6.8Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache49
mongodb vulnerabilities
CVEs affecting mongodb, newest first. Open any entry for full detail, references, and exploit status.
193 CVEsRSS
CVE-2026-13062Medium· 6.5MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the m…
CVE-2026-13060Medium· 6.5$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and …
CVE-2026-9101Medium· 4.3Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
CVE-2026-9100Medium· 5.9The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to eithe…
CVE-2026-8843Medium· 6.5Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "querya…
CVE-2026-6811Medium· 5.9Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
CVE-2026-8431High· 7.2An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versio…
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versio…
CVE-2025-14345Medium· 4.2A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very sho…
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very sho…
CVE-2025-12119Medium· 6.8A mongoc_bulk_operation_t may read invalid memory if large options are passed.
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
CVE-2025-11979Medium· 5.3An authorized user may crash the MongoDB server by causing buffer over-read
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.…
CVE-2025-11695High· 8.0When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
CVE-2025-10060Medium· 6.5MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork…
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result …