CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,170 CVEs published, 238 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,170
Show in the list
Critical, last 7 days
238
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product mongodb:mongodb. Show all products

119 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-89099High 7.5Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
Assigned by mongodb
Sep 11, 2026
CVE-2026-82076Medium 6.5Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
Assigned by mongodb
Sep 8, 2026
CVE-2026-82075High 7.5Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
Assigned by mongodb
Sep 8, 2026
CVE-2026-82074Medium 6.5Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
Assigned by mongodb
Sep 8, 2026
CVE-2026-82073Medium 6.5Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search
Assigned by mongodb
Sep 8, 2026
CVE-2026-82071High 8.1Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
Assigned by mongodb
Sep 8, 2026
CVE-2026-82070Medium 6.5Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
Assigned by mongodb
Sep 8, 2026
CVE-2026-82069Low 2.7Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
Assigned by mongodb
Sep 8, 2026
CVE-2026-82068Medium 6.5Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
Assigned by mongodb
Sep 8, 2026
CVE-2026-82067High 8.1Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
Assigned by mongodb
Sep 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.