Product by Open Source
Mongodb PHP Driver
27 known vulnerabilities in Mongodb PHP Driver (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-81525 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver | 8.1 | |
| High | CVE-2026-81522 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver | 8.1 | |
| High | CVE-2026-96746 | Heap buffer overflow via mid-scan command list growth in client topology monitoring | 6.5 | |
| High | CVE-2026-75159 | MongoDB BI Connector: Double Free | 5.9 | |
| High | CVE-2026-96748 | Connection redirection via percent-encoded delimiter injection in connection string hosts | 6.5 | |
| High | CVE-2026-6811 | PHP Stack Exhaustion | 7.5 | |
| High | CVE-2026-96749 | Heap out-of-bounds write via signed size overflow in BSON document encoding | 8.4 | |
| High | CVE-2026-81526 | Cross-database write redirection via unvalidated dotted database name in bulk write namespaces | 6.5 | |
| High | CVE-2026-96744 | MongoDB Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic | 7.1 | |
| High | CVE-2026-84964 | Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client | 5.9 | |
| High | CVE-2026-96750 | Shell script injection via server-supplied database name in Open MongoDB shell | 7.1 | |
| Medium | CVE-2026-96745 | PHP object injection via unsuppressible __pclass class inference in command monitoring events | 5.6 | |
| High | CVE-2026-81529 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | 7.1 | |
| Medium | CVE-2026-81527 | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation | 6.5 | |
| High | CVE-2026-81521 | MongoDB GO Driver: Resource Injection | 6.5 | |
| Medium | CVE-2026-84963 | Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser | 5.3 | |
| Medium | CVE-2026-84968 | Heap out-of-bounds read via corrupt nested BSON in field path error message | 5.3 | |
| Medium | CVE-2026-81530 | KMS master key exposure via unredacted credential serialization in driver settings string | 5.6 | |
| Medium | CVE-2026-96747 | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption | 5.0 | |
| Medium | CVE-2026-84966 | BSON element injection via NUL-embedded document keys in builder append | 5.1 | |
| Medium | CVE-2026-84965 | Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds | 5.1 | |
| Medium | CVE-2026-81528 | NoSQL injection via array replacement bypassing update shape validation in driver write path | 5.4 | |
| Medium | CVE-2026-84962 | Authenticated KMS request forgery via CRLF injection in GCP key identifier strings | 4.2 | |
| Medium | CVE-2026-81524 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver | 5.4 | |
| Medium | CVE-2026-84967 | Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal | 4.3 |