mongodb has 117 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 111 in the last 90 days against 5 in the 90 before. The busiest recent month was September 2026 with 71. The median CVSS is 6.5 (medium), with 3 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-943 (17) and CWE-617 (10). Most affected products: mongodb (50), c_driver (9), mongoid (8).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 6.5
Publish → KEV: —
Last 90 days: 111 prev 5

Weakness classes

Products

mongodb 50
c_driver 9
mongoid 8
bi_connector_odbc_driver 7
Laravel MongoDB (PHP) 4
Python Driver 4

Follow mongodb:RSS feed Save a search →Embed badge ↗

117

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

MongoDB vulnerabilities

CVEs affecting MongoDB, newest first. Open any entry for full detail, references, and exploit status.

117 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

MongoDB vulnerabilities

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal i…

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal iden…

mongodb: Reject "." and NUL bytes in database and collection names

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be clie…

A use-after-free security issue exists in the server's query execution memory tracking subsystem

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths

A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)

An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework