Vendor
MongoDB
No CISA KEV deadline is open. CISA last added a MongoDB CVE on 29 Dec 2025.
Tracked since 17 Jun · latest article Fri 25 Sep · RSS
Exploited, by due date
CSV downloadCVEProductAddedDue · federal deadline
Deadlines passed
Products
11 products · 22 CVEs in coverage6 more products
Python Driver2 CVEs · 0 in KEVlatest 25 SepPHP Driver1 CVE · 0 in KEVlatest 25 SepCompass1 CVE · 0 in KEVlatest 25 SepPHP Library1 CVE · 0 in KEVlatest 28 AugBI Connector ODBC Driver1 CVE · 0 in KEVlatest 18 AugSeveral products1 CVE · 0 in KEVlatest 17 Jun
Trends
CVEs in coverage by publication month
Publication dates are still being collected (2 of 22).
Fix listed for 15 of 22 CVEs in coverage.
7 articles from 1 outlet since 17 Jun; the latest 31 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 25 Sep · 19:22 UTC | SecurityOnline | MongoDB Fixes Seven Driver Flaws, Including Rogue Server Attacks |
| Mon 21 Sep · 02:59 UTC | SecurityOnline | MongoDB Libraries Hit by 14 Flaws Risking Data Theft and Loss |
| Thu 10 Sep · 03:31 UTC | SecurityOnline | MongoDB Patches Critical Flaw That Could Disable Authorisation |
| Fri 28 Aug · 18:17 UTC | SecurityOnline | MongoDB patches dozen flaws, warns of cross tenant data leak risk |
| Tue 18 Aug · 14:50 UTC | SecurityOnline | MongoDB patches 32 flaws, including critical CVE-2026-19001 |
| Thu 30 Jul · 15:06 UTC | SecurityOnline | MongoDB patches critical flaw amid 27 new security vulnerabilities |
| Wed 17 Jun · 01:30 UTC | SecurityOnline | MongoDB flaws risk unauthenticated crashes and data corruption |
- MongoDB Fixes Seven Driver Flaws, Including Rogue Server AttacksSecurityOnline
- MongoDB Libraries Hit by 14 Flaws Risking Data Theft and LossSecurityOnline
- MongoDB Patches Critical Flaw That Could Disable AuthorisationSecurityOnline
- MongoDB patches dozen flaws, warns of cross tenant data leak riskSecurityOnline
- MongoDB patches 32 flaws, including critical CVE-2026-19001SecurityOnline
- MongoDB patches critical flaw amid 27 new security vulnerabilitiesSecurityOnline
- MongoDB flaws risk unauthenticated crashes and data corruptionSecurityOnline
All CVEs in coverage
22CVE-2026-93762Data deletion and attribute disclosure via field-name method injection in in-memory queriesCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-19001MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object namesCVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2026-93760NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardCVSS8.3High–Not in KEV0.5%EPSS1article
CVE-2026-82075Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServiceCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-82064Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-82067Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupCVSS9.2Critical–Not in KEV0.5%EPSS1article
CVE-2026-81525Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP DriverCVSS8.6High–Not in KEV0.5%EPSS1article
CVE-2026-93393Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamCVSS9.2Critical–Not in KEV0.5%EPSS0articles
CVE-2026-93761Denial of service via unbounded regex matching in Mongoid's in-memory query matcherCVSS8.7High–Not in KEV0.5%EPSS0articles
CVE-2026-93759Server-side JavaScript injection via string query criteria bypassing the strict operator allowlistCVSS8.8High–Not in KEV0.4%EPSS1article
CVE-2026-13072MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionCVSS9.2Critical–Not in KEV0.4%EPSS1article
10 more CVEs
CVE-2026-96746Heap buffer overflow via mid-scan command list growth in client topology monitoringCVSS8.3High–Not in KEV0.4%EPSS1article
CVE-2026-11933Post-authentication use-after-free in server-side JavaScript BSON-to-array conversionCVSS8.8High–Not in KEV0.4%EPSS1article
CVE-2026-13059Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassCVSS8.6High–Not in KEV0.4%EPSS1article
CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hostsCVSS8.3High–Not in KEV0.4%EPSS1article
CVE-2026-93758Cross-principal document update, theft, and deletion via unvalidated id in nested attributesCVSS8.6High–Not in KEV0.4%EPSS0articles
CVE-2026-96745PHP object injection via unsuppressible __pclass class inference in command monitoring eventsCVSS6.3Medium–Not in KEV0.3%EPSS1article
CVE-2026-96750Shell script injection via server-supplied database name in Open MongoDB shellCVSS7.3High–Not in KEV0.2%EPSS1article
CVE-2026-96749Heap out-of-bounds write via signed size overflow in BSON document encodingCVSS8.4High–Not in KEV0.2%EPSS1article
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.