CVE-2026-82075Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServiceCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-82064Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-82067Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupCVSS9.2Critical–Not in KEV0.5%EPSS1article
CVE-2026-9743MongoDB server vulnerabilityCVSS7.1High–Not in KEV0.5%EPSS1article
CVE-2026-13072MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionCVSS9.2Critical–Not in KEV0.4%EPSS1article
CVE-2026-13059Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassCVSS8.6High–Not in KEV0.4%EPSS1article
CVE-2026-9750MongoDB Server vulnerabilityCVSS7.1High–Not in KEV0.4%EPSS1article
CVE-2026-9740MongoDB Server vulnerabilityCVSS8.7High–Not in KEV0.3%EPSS1article
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.