Known Vulnerabilities for products from MongoDB
Listed below are 20 of the newest known vulnerabilities associated with the vendor "MongoDB".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-96750 json | Not Provided | 2026-09-24 | 2026-09-25 | |
| CVE-2026-96749 json | Not Provided | 2026-09-24 | 2026-09-26 | |
| CVE-2026-96747 json | Not Provided | 2026-09-24 | 2026-09-24 | |
| CVE-2026-96746 json | Not Provided | 2026-09-24 | 2026-09-24 | |
| CVE-2026-96745 json | Not Provided | 2026-09-24 | 2026-09-24 | |
| CVE-2026-96744 json | Not Provided | 2026-09-24 | 2026-09-24 | |
| CVE-2026-93765 json | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input w... | Not Provided | 2026-09-18 | 2026-09-25 |
| CVE-2026-93764 json | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encrypti... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93763 json | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an a... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93762 json | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an e... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93761 json | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may all... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93760 json | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93759 json | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the databa... | Not Provided | 2026-09-18 | 2026-09-24 |
| CVE-2026-93758 json | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user ... | Not Provided | 2026-09-18 | 2026-09-25 |
| CVE-2026-93395 json | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processin... | Not Provided | 2026-09-17 | 2026-09-25 |
| CVE-2026-93394 json | A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and tran... | Not Provided | 2026-09-17 | 2026-09-25 |
| CVE-2026-93393 json | Not Provided | 2026-09-17 | 2026-09-18 | |
| CVE-2026-92758 json | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive info... | Not Provided | 2026-09-17 | 2026-09-24 |
| CVE-2026-92757 json | Not Provided | 2026-09-17 | 2026-09-17 | |
| CVE-2026-92756 json | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider'... | Not Provided | 2026-09-17 | 2026-09-24 |
Known software with vulnerabilities from MongoDB
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Mongodb | Bson | 1.0.0 |
| Application | Mongodb | Js-bson | 0.0.5 |
| Application | Mongodb | Kubernetes Operator | 0.10 |
| Application | Mongodb | Libbson | 0.2.0 |
| Application | Mongodb | Libmongocrypt | 0.3.0 |
| Application | Mongodb | Mongodb | - |
| Application | Mongodb | Mongodb Enterprise Kubernetes Operator | 0.10 |
| Application | Mongodb | Ops Manager | 1.6.0 |