Product by MongoDB
Mongodb Server
189 known vulnerabilities in Mongodb Server (MongoDB), 1 of them actively exploited (CISA KEV).
Key figures
189
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read In CISA KEValso in 2 other products | 7.5 | |
| Critical | CVE-2026-82067 | MongoDB Server: Improper Handling of Case Sensitivity | 8.1 | |
| High | CVE-2021-32040 | Large aggregation pipelines with a specific stage can crash mongod under default configuration | 6.5 | |
| High | CVE-2026-82064 | MongoDB Server: Reachable Assertion | 7.5 | |
| High | CVE-2026-82075 | MongoDB Server: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-18692 | MongoDB Server: Use After Free | 8.8 | |
| High | CVE-2020-7925 | Denial of Service when processing malformed Role names | 7.5 | |
| High | CVE-2019-20925 | Denial of service via malformed network packet | 7.5 | |
| High | CVE-2026-82071 | MongoDB Server: Out-of-bounds Write | 8.1 | |
| High | CVE-2026-8053 | FlatBSON Duplicate Field Index Drift | 8.8 | |
| High | CVE-2026-82061 | MongoDB Server: Use After Free | 8.1 | |
| High | CVE-2026-88025 | MongoDB C# Driver: Improper Neutralization of Special Elements in Data Query Logic | 8.3 | |
| High | CVE-2026-88024 | MongoDB Rust Driver: Improper Neutralization of Special Elements in Data Query Logic | 8.3 | |
| High | CVE-2026-88031 | GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver | 8.1 | |
| High | CVE-2026-88033 | MongoDB Java Driver: Improper Neutralization of Special Elements in Data Query Logic | 8.3 | |
| High | CVE-2026-88034 | MongoDB C++ Driver: Improper Neutralization of Special Elements in Data Query Logic | 8.3 | |
| High | CVE-2026-88022 | MongoDB Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic | 7.7 | |
| High | CVE-2026-18697 | MongoDB Server: Reachable Assertion | 7.5 | |
| Medium | CVE-2018-20802 | Post-auth queries on compound index may crash mongod | 6.5 | |
| Critical | CVE-2026-13072 | MongoDB Server: Heap-based Buffer Overflow | 8.1 | |
| High | CVE-2026-82053 | MongoDB Server: Incorrect Authorization | 8.1 | |
| High | CVE-2026-82052 | $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars | 6.5 | |
| High | CVE-2025-0755 | MongoDB C Driver bson library may be susceptible to buffer overflow | 8.4 | |
| Medium | CVE-2020-7928 | Improper neutralization of null byte leads to read overrun | 6.5 | |
| Medium | CVE-2018-20803 | Infinite loop in aggregation expression | 6.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29sans-atrisk-mail,
- Official Papal Prayer App Exposed Data of Every Usersans-newsbites-mail,
- CISA Adds One Known Exploited Vulnerability to Catalogcisa-advisories,