Technology · MongoDB
MongoDB Server vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 86 vulnerabilities in MongoDB Server: 20 in the last 7 days and 36 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-120825, was published on 10 November 2026. 3 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 20
- Last 90 days
- 36
- Critical, all time
- 2
- Exploited in the wild
- 1
About MongoDB Server
A document-oriented NoSQL database program that uses JSON-like documents with optional schemas.
Latest MongoDB Server vulnerabilities
- CVE-2026-120825: MongoDB Server authorization bypass in aggregation pipelinemediumCVSS 6.5
- CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validationhighCVSS 8.8
- CVE-2026-120823: MongoDB Server missing authorization check in aggregation frameworkmediumCVSS 4.3
- CVE-2026-120822: MongoDB Server authorization bypass in applyOpsmediumCVSS 6.7
- CVE-2026-120821: MongoDB Server use-after-free in aggregation frameworkmediumCVSS 6.5
- CVE-2026-120820: MongoDB Server memory exhaustion in FLE2 operation statisticsmediumCVSS 4.3
- CVE-2026-120819: MongoDB Server memory disclosure in JavaScript executionmediumCVSS 4.3
- CVE-2026-120818: MongoDB Server use-after-free in server-side JavaScript aggregationhighCVSS 7.1
- CVE-2026-120817: MongoDB Server race condition in schema validationmediumCVSS 6.5
- CVE-2026-118383: MongoDB Server use-after-free in replication catch-upcriticalCVSS 9
- CVE-2026-120815: MongoDB Server authorization bypass via localhost exceptionhighCVSS 8.4
- CVE-2026-120814: MongoDB Server privilege escalation in sharding subsystemhighCVSS 7.2
- CVE-2026-120813: MongoDB Server client-side field-level encryption schema parsing bypassmediumCVSS 5.9
- CVE-2026-120812: MongoDB Server denial of service in query processingmediumCVSS 6.5
- CVE-2026-120811: MongoDB Server use-after-free in query plan cachemediumCVSS 5.9
- CVE-2026-120810: MongoDB server denial of service in aggregation frameworkmediumCVSS 6.5
- CVE-2026-120809: MongoDB use-after-free read in SBE aggregation pipelinemediumCVSS 6.8
- CVE-2026-120807: MongoDB X.509 cluster authentication privilege escalationmediumCVSS 6.6
- CVE-2026-120806: MongoDB Server incomplete role cleanup in user managementmediumCVSS 5.5
- CVE-2026-120805: MongoDB Server Queryable Encryption metadata authorization bypassmediumCVSS 4.3
- CVE-2026-96297: MongoDB Server use-after-free in aggregation pipelinemediumCVSS 6.5EPSS 0.2%
- CVE-2026-104004: MongoDB Server denial of service in collection validationmediumCVSS 6.5EPSS 0.2%
- CVE-2026-103965: MongoDB Server aggregation framework constant value handling in query rewritingmediumCVSS 5.4EPSS 0.1%
- CVE-2026-89099: MongoDB Server race condition in document value layerhighCVSS 7.5EPSS 0.3%
- CVE-2026-82076: MongoDB Server integer overflow in query plannermediumCVSS 6.5EPSS 0.4%
Most severe MongoDB Server vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-14847: MongoDB Server uninitialized heap memory disclosure in Zlib headerscriticalexploited in the wildCVSS 8.7EPSS 68.9%
- CVE-2026-118383: MongoDB Server use-after-free in replication catch-upcriticalCVSS 9
- CVE-2026-18691: MongoDB Server SASL mechanism downgrade in intra-cluster authenticationhighCVSS 8.8EPSS 0.4%
- CVE-2026-8053: MongoDB Server out-of-bounds write in time-series collectionshighCVSS 8.8EPSS 0.1%
- CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validationhighCVSS 8.8
- CVE-2026-11933: MongoDB Server use-after-free in server-side JavaScript enginehighCVSS 8.8
- CVE-2026-120815: MongoDB Server authorization bypass via localhost exceptionhighCVSS 8.4
- CVE-2026-82053: MongoDB LDAP connection pooling privilege escalationhighCVSS 8.1EPSS 0.4%
- CVE-2026-13072: MongoDB Server heap overflow in aggregation pipeline processinghighCVSS 8.1
- CVE-2026-13059: MongoDB Server authorization bypass in query-level access controlshighCVSS 8.1
Vulnerabilities per week
3 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 13 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 3 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 20 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many MongoDB Server vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/mongodb-server)<a href="https://junglewise.ai/threats/technologies/mongodb-server"><img src="https://junglewise.ai/threats/technologies/mongodb-server/badge.svg" alt="MongoDB Server vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/mongodb-server.json, and this page as text at https://junglewise.ai/threats/technologies/mongodb-server.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "MongoDB Server vulnerabilities", https://junglewise.ai/threats/technologies/mongodb-server, 13 November 2026.