MS
Product
MongoDB Server
On CISA KEVExploited in the wild
33
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 14Medium 18Low 0
Watch
Add MongoDB Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14847 In wildKEV | 7.5 | Dec 19 | Zlib compressed protocol header length confusion may allow memory read Affected: 8.2 before 8.2.3; 8.0 before 8.0.17; 7.0 before 7.0.28; 6.0 before 6.0.27; 5.0 before 5.0.32; 4.4 before 4.4.30; +3 more |
| CVE-2026-8201 | 8.8 | May 13 | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields Affected: 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-8053 | 8.8 | May 12 | FlatBSON Duplicate Field Index Drift Affected: 5.0 before 5.0.33; 6.0 before 6.0.28; 7.0 before 7.0.34; 8.0 before 8.0.23; 8.2 before 8.2.9; 8.3 before 8.3.2 |
| CVE-2026-4148 | 8.8 | Mar 17 | ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators Affected: 8.2 before 8.2.6; 8.0 before 8.0.20; 7.0 before 7.0.31 |
| CVE-2025-10491 | 7.8 | Sep 15 | MongoDB Windows installation MSI may leave ACLs unset on custom installation directories Affected: 6.0 before 6.0.25; 7.0 before 7.0.21; 8.0 before 8.0.5 |
| CVE-2026-4358 | 7.5 | Mar 17 | Memory safety issues in slot-based execution hash table spill Affected: 8.2 before 8.2.6; 8.0 before 8.0.20; 7.0 before 7.0.31 |
| CVE-2026-1849 | 7.5 | Feb 10 | Mongod can run out of stack memory when expressions create deeply nested documents Affected: 8.0 before 8.0.18; 7.0 before 7.0.29; 8.2 before 8.2.2 |
| CVE-2026-1850 | 7.5 | Feb 10 | An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification Affected: 8.0 before 8.0.18; 8.2 before 8.2.4 |
| CVE-2026-1848 | 7.5 | Feb 10 | Connections received from the proxy port may not count towards total accepted connections Affected: 8.2 before 8.2.4; 8.0 before 8.0.18; 7.0 before 7.0.29 |
| CVE-2026-1847 | 7.5 | Feb 10 | MongoDB Server may crash when inserting large documents Affected: 8.0 before 8.0.18; 7.0 before 7.0.29 |
| CVE-2026-25611 | 7.5 | Feb 10 | Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server Affected: 8.2 before 8.2.4; 8.0 before 8.0.18; 7.0 before 7.0.29 |
| CVE-2025-13644 | 7.5 | Nov 25 | MongoDB may be susceptible to Invariant Failure due to batched delete Affected: 8.0 before 8.0.13; 7.0 before 7.0.26; 8.1 before 8.1.2 |
| CVE-2025-10060 | 7.5 | Sep 5 | MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation Affected: 6.0 before 6.0.25; 7.0 before 7.0.22; 8.0 before 8.0.12 |
| CVE-2025-0755 | 7.5 | Mar 18 | MongoDB C Driver bson library may be susceptible to buffer overflow Affected: 8.0 before 8.0.1; 7.0 before 7.0.16 |
Showing 14