MongoDB
Number 50 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: MONGODB, MongoDB
Total vulnerabilities
383
Critical
5
High
112
Known Exploited
1
Exploit available
0
Network, no login needed
22.2%
Of 383 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 283 | 4 | 85 | 182 | 12 | 0 |
| 2025 | 37 | 1 | 16 | 17 | 3 | 0 |
| 2024 | 18 | 0 | 5 | 12 | 1 | 0 |
| 2023 | 6 | 0 | 1 | 4 | 1 | 0 |
| 2022 | 4 | 0 | 0 | 4 | 0 | 0 |
| 2021 | 14 | 0 | 0 | 14 | 0 | 0 |
| 2020 | 18 | 0 | 3 | 15 | 0 | 0 |
| 2019 | 3 | 0 | 2 | 1 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| MongoDB Server | 201 | 54 |
| C Driver | 24 | 5 |
| C# Driver | 17 | 3 |
| BI Connector | 8 | 5 |
| Mongoid | 8 | 6 |
| BI Connector ODBC Driver | 7 | 6 |
| libmongocrypt | 7 | 1 |
| PHP Driver | 6 | 1 |
| C++ Driver | 5 | 2 |
| Database Tools | 5 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 74 | 28 |
| Improper Neutralization of Special Elements in Data Query Logic | 24 | 15 |
| Reachable Assertion | 21 | 4 |
| Incorrect Authorization | 18 | 4 |
| Allocation of Resources Without Limits or Throttling | 16 | 3 |
| Information Disclosure | 14 | 0 |
| Improper Certificate Validation | 11 | 4 |
| Improper Input Validation | 11 | 3 |
| Missing Authorization | 8 | 1 |
| Reachable assertion | 7 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read | High | 83.2% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-120828 | Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage | High | n/a | |
| CVE-2026-120826 | Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access | Medium | n/a | |
| CVE-2026-120825 | Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access | Medium | n/a | |
| CVE-2026-120824 | Post-authentication use-after-free in MongoDB Server time-series bucket validation | High | n/a | |
| CVE-2026-120823 | Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data | Medium | n/a | |
| CVE-2026-120822 | Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access | Medium | n/a | |
| CVE-2026-120821 | Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines | Medium | n/a | |
| CVE-2026-120820 | Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service | Medium | n/a | |
| CVE-2026-120819 | Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator | Medium | n/a | |
| CVE-2026-120818 | Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure | High | n/a |