# MongoDB Compass vulnerabilities Source: https://junglewise.ai/threats/technologies/compass Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/compass.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 6 vulnerabilities in MongoDB Compass: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115929, was published on 24 October 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 6 (0 critical, 0 exploited in the wild) ## About MongoDB Compass A graphical user interface for interacting with MongoDB databases. ## Latest MongoDB Compass vulnerabilities - [CVE-2026-115929: MongoDB Compass TLS certificate validation bypass in Electron](https://junglewise.ai/threats/cve-2026-115929-mongodb-compass-relies-on-electron-a-third-party-runtime-that) (medium, CVSS 6.8, published 24 Oct 2026) - [CVE-2026-113870: MongoDB Compass code execution in BSON value escaping](https://junglewise.ai/threats/cve-2026-113870-mongodb-compass-improperly-escapes-certain-bson-values-when) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-96750: MongoDB Compass code injection via unescaped database name](https://junglewise.ai/threats/cve-2026-96750-mongodb-compass-can-interpolate-a-database-name-without-escaping) (high, CVSS 7.1, published 24 Sep 2026) - [CVE-2026-14881: MongoDB Compass OS command injection via connection import](https://junglewise.ai/threats/cve-2026-14881-mongodb-compass-os-command-injection-via-connection-import) (high, CVSS 7.8, published 22 Jul 2026) - [CVE-2026-9101: MongoDB Compass prototype pollution in CSV import](https://junglewise.ai/threats/cve-2026-9101-mongodb-compass-prototype-pollution-in-csv-import) (medium, CVSS 4.3, published 20 May 2026) - [CVE-2024-6376: MongoDB Compass code injection in EJSON shell parser](https://junglewise.ai/threats/cve-2024-6376-mongodb-compass-code-injection-in-ejson-shell-parser) (low, CVSS 3.1, published 1 Jul 2024) ## Most severe MongoDB Compass vulnerabilities - [CVE-2026-113870: MongoDB Compass code execution in BSON value escaping](https://junglewise.ai/threats/cve-2026-113870-mongodb-compass-improperly-escapes-certain-bson-values-when) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-14881: MongoDB Compass OS command injection via connection import](https://junglewise.ai/threats/cve-2026-14881-mongodb-compass-os-command-injection-via-connection-import) (high, CVSS 7.8, published 22 Jul 2026) - [CVE-2026-96750: MongoDB Compass code injection via unescaped database name](https://junglewise.ai/threats/cve-2026-96750-mongodb-compass-can-interpolate-a-database-name-without-escaping) (high, CVSS 7.1, published 24 Sep 2026) - [CVE-2026-115929: MongoDB Compass TLS certificate validation bypass in Electron](https://junglewise.ai/threats/cve-2026-115929-mongodb-compass-relies-on-electron-a-third-party-runtime-that) (medium, CVSS 6.8, published 24 Oct 2026) - [CVE-2026-9101: MongoDB Compass prototype pollution in CSV import](https://junglewise.ai/threats/cve-2026-9101-mongodb-compass-prototype-pollution-in-csv-import) (medium, CVSS 4.3, published 20 May 2026) - [CVE-2024-6376: MongoDB Compass code injection in EJSON shell parser](https://junglewise.ai/threats/cve-2024-6376-mongodb-compass-code-injection-in-ejson-shell-parser) (low, CVSS 3.1, published 1 Jul 2024) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other MongoDB technologies - [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server): 86 vulnerabilities - [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver): 41 vulnerabilities - [MongoDB](https://junglewise.ai/threats/technologies/mongodb): 25 vulnerabilities - [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi): 8 vulnerabilities - [MongoDB Bi Connector Odbc Driver](https://junglewise.ai/threats/technologies/bi-connector-odbc-driver): 7 vulnerabilities - [MongoDB Mongoid](https://junglewise.ai/threats/technologies/mongoid): 7 vulnerabilities - [MongoDB PHP Driver](https://junglewise.ai/threats/technologies/php-driver): 7 vulnerabilities - [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt): 6 vulnerabilities - [MongoDB Python Driver](https://junglewise.ai/threats/technologies/mongodb-python-driver): 6 vulnerabilities - [MongoDB Go Driver](https://junglewise.ai/threats/technologies/go-driver): 5 vulnerabilities - [MongoDB Mongo-Express](https://junglewise.ai/threats/technologies/mongo-express): 5 vulnerabilities - [MongoDB Node.js Driver](https://junglewise.ai/threats/technologies/node-js-driver): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MongoDB Compass vulnerabilities", https://junglewise.ai/threats/technologies/compass, 13 November 2026.