Known Vulnerabilities for products from MongoDB
Listed below are 20 of the newest known vulnerabilities associated with the vendor "MongoDB".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-123617 json | Not Provided | 2026-11-06 | 2026-11-06 | |
| CVE-2026-121415 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120959 json | Not Provided | 2026-11-03 | 2026-11-06 | |
| CVE-2026-120956 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120955 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120952 json | Not Provided | 2026-11-03 | 2026-11-06 | |
| CVE-2026-120684 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120678 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120673 json | Not Provided | 2026-11-03 | 2026-11-03 | |
| CVE-2026-120567 json | Not Provided | 2026-11-03 | 2026-11-06 | |
| CVE-2026-107325 json | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when a... | Not Provided | 2026-10-08 | 2026-10-27 |
| CVE-2026-107324 json | An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application vali... | Not Provided | 2026-10-08 | 2026-10-27 |
| CVE-2026-106438 json | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs contai... | Not Provided | 2026-10-08 | 2026-10-27 |
| CVE-2026-106437 json | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later ap... | Not Provided | 2026-10-08 | 2026-10-27 |
| CVE-2026-106436 json | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. T... | Not Provided | 2026-10-08 | 2026-10-13 |
| CVE-2026-106435 json | The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containin... | Not Provided | 2026-10-08 | 2026-10-15 |
| CVE-2026-106433 json | Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type whe... | Not Provided | 2026-10-08 | 2026-10-27 |
| CVE-2026-106432 json | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected ap... | Not Provided | 2026-10-08 | 2026-10-13 |
| CVE-2026-93765 json | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input w... | Not Provided | 2026-09-18 | 2026-09-25 |
| CVE-2026-93764 json | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encrypti... | Not Provided | 2026-09-18 | 2026-09-24 |
Known software with vulnerabilities from MongoDB
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Mongodb | Bson | 1.0.0 |
| Application | Mongodb | Js-bson | 0.0.5 |
| Application | Mongodb | Kubernetes Operator | 0.10 |
| Application | Mongodb | Libbson | 0.2.0 |
| Application | Mongodb | Libmongocrypt | 0.3.0 |
| Application | Mongodb | Mongodb | - |
| Application | Mongodb | Mongodb Enterprise Kubernetes Operator | 0.10 |
| Application | Mongodb | Ops Manager | 1.6.0 |