Product by Open Source
Mongodb Ef Core Provider
15 known vulnerabilities in Mongodb Ef Core Provider (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-120678 | MongoDB C Driver: Missing Release of Memory after Effective Lifetime | 7.5 | |
| High | CVE-2026-120955 | MongoDB C Driver: NULL Pointer Dereference | 7.5 | |
| High | CVE-2026-119179 | MongoDB Node.js Driver: Sensitive Information in Resource Not Removed Before Reuse | 7.0 | |
| High | CVE-2026-119675 | mongorestore may bypass collection guards through a system.buckets prefix | 8.6 | |
| High | CVE-2026-120952 | MongoDB Atlas SQL ODBC Driver: Out-of-bounds Write | 7.1 | |
| High | CVE-2026-120956 | remote abort and memory disclosure from a malformed cursor.ns | 7.1 | |
| Medium | CVE-2026-120684 | MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password | 6.5 | |
| Medium | CVE-2026-120673 | Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command | 5.5 | |
| Medium | CVE-2026-120954 | Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views | 3.7 | |
| Medium | CVE-2026-119672 | mongofiles may disclose GridFS content to standard output through a stored filename | 4.8 | |
| Medium | CVE-2026-120953 | MongoDB Atlas SQL JDBC Driver: Open Redirect | 4.3 | |
| Medium | CVE-2026-120567 | EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference | 5.4 | |
| Low | CVE-2026-120959 | MongoDB Atlas SQL: Out-of-bounds Write | 3.7 | |
| Low | CVE-2026-119674 | mongorestore may restore encoded collection names into an unintended collection | 3.7 | |
| Low | CVE-2026-119673 | mongofiles may write outside the working directory through a symlink | 2.8 |