Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

MongoDB

Source -

CISACNA

BOS Name -

MongoDB, Inc.

CNA CVEs -

6

ADP CVEs -

0

CISA CVEs -

2

NVD CVEs -

0
Related CVEsRelated ProductsRelated AssignersReports
8Vulnerabilities found
CVE-2026-5170
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-6||MEDIUM
EPSS-0.05% / 14.16%
||
7 Day CHG~0.00%
Published-30 Mar, 2026 | 15:28
Updated-02 Apr, 2026 | 17:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Users could trigger a crash of mongod primaries during promotion to sharded

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

Action-Not Available
Vendor-MongoDB, Inc.
Product-mongodbMongoDB Server
CWE ID-CWE-617
Reachable Assertion
CVE-2025-14911
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-7.1||HIGH
EPSS-0.06% / 19.22%
||
7 Day CHG~0.00%
Published-27 Jan, 2026 | 17:29
Updated-26 Feb, 2026 | 22:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Action-Not Available
Vendor-MongoDB, Inc.
Product-Mongo-c-driver
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2025-14847
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-8.7||HIGH
EPSS-77.51% / 98.99%
||
7 Day CHG~0.00%
Published-19 Dec, 2025 | 11:00
Updated-26 Feb, 2026 | 16:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2026-01-19||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Zlib compressed protocol header length confusion may allow memory read

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Action-Not Available
Vendor-MongoDB, Inc.
Product-mongodbMongoDB ServerMongoDB and MongoDB Server
CWE ID-CWE-130
Improper Handling of Length Parameter Inconsistency
CVE-2025-12119
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.01% / 0.30%
||
7 Day CHG-0.00%
Published-18 Nov, 2025 | 20:21
Updated-14 Jan, 2026 | 19:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Bulk write with options may read invalid memory

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Action-Not Available
Vendor-MongoDB, Inc.
Product-c_driverphp_driverC DriverPHP Driver
CWE ID-CWE-825
Expired Pointer Dereference
CVE-2025-12100
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-8.8||HIGH
EPSS-0.02% / 4.54%
||
7 Day CHG~0.00%
Published-23 Oct, 2025 | 21:02
Updated-26 Feb, 2026 | 16:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.

Action-Not Available
Vendor-MongoDB, Inc.
Product-BI Connector ODBC driver
CWE ID-CWE-276
Incorrect Default Permissions
CVE-2025-11575
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-8.8||HIGH
EPSS-0.02% / 3.41%
||
7 Day CHG~0.00%
Published-23 Oct, 2025 | 00:22
Updated-26 Feb, 2026 | 16:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

Action-Not Available
Vendor-MongoDB, Inc.
Product-Atlas SQL ODBC driver
CWE ID-CWE-276
Incorrect Default Permissions
CVE-2025-11695
Assigner-MongoDB, Inc.
ShareView Details
Assigner-MongoDB, Inc.
CVSS Score-8||HIGH
EPSS-0.02% / 6.54%
||
7 Day CHG~0.00%
Published-13 Oct, 2025 | 16:22
Updated-26 Feb, 2026 | 17:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Configuration may unexpectedly disable certificate validation

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

Action-Not Available
Vendor-MongoDB, Inc.
Product-rust_driverRust Driver
CWE ID-CWE-295
Improper Certificate Validation
CVE-2019-10758
Assigner-Snyk
ShareView Details
Assigner-Snyk
CVSS Score-9.9||CRITICAL
EPSS-94.35% / 99.96%
||
7 Day CHG~0.00%
Published-24 Dec, 2019 | 21:08
Updated-27 Oct, 2025 | 17:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2022-06-10||Apply updates per vendor instructions.

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Action-Not Available
Vendor-n/aMongoDB, Inc.
Product-mongo-expressmongo-expressmongo-express
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')