MO
Database
MongoDB
On CISA KEVExploited in the wild
296
CVEs
2
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 7High 97Medium 181Low 4
Watch
Add MongoDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-10758 In wildKEV | 9.9 | Dec 24 | MongoDB mongo-express Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-19001 | 9.8 | Aug 12 | MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names Affected: 1.0.0 before 1.4.9 |
| CVE-2025-40906 | 9.8 | May 16 | BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities Affected: through 0.8.4 |
| CVE-2025-3085 | 9.8 | Apr 1 | MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked Affected: 5.0 before 5.0.31; 6.0 before 6.0.20; 7.0 before 7.0.16; 8.0. before 8.0.4 |
| CVE-2024-8654 | 9.8 | Sep 10 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour Affected: 6.0.3 |
| CVE-2024-1351 | 9.8 | Mar 7 | MongoDB Server may allow successful untrusted connection Affected: 4.4.0 before 4.4.29; 5.0.0 before 5.0.25; 6.0.0 before 6.0.14; 7.0.0 before 7.0.6 |
| CVE-2017-15535 | 9.1 | Nov 1 | MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a… Affected: 3.4.0 before 3.4.10 |
Showing 7