{"schema_version":1,"title":"MongoDB vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in MongoDB: 0 in the last 7 days and 10 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-82075, was published on 8 September 2026.","url":"https://junglewise.ai/threats/technologies/mongodb","json_url":"https://junglewise.ai/threats/technologies/mongodb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mongodb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":12,"critical":1,"exploited":1,"last_7_days":0,"last_30_days":9,"last_90_days":10,"last_365_days":12},"latest":[{"cve":"CVE-2026-82075","cvss":7.5,"epss":0.0052,"slug":"cve-2026-82075-mongodb-mongos-uncontrolled-resource-consumption","title":"MongoDB mongos uncontrolled resource consumption","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:36.53+00:00","url":"https://junglewise.ai/threats/cve-2026-82075-mongodb-mongos-uncontrolled-resource-consumption"},{"cve":"CVE-2026-82073","cvss":6.5,"epss":0.0033,"slug":"cve-2026-82073-mongodb-server-aggregation-framework-privilege-escalation","title":"MongoDB Server aggregation framework privilege escalation","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:36.273+00:00","url":"https://junglewise.ai/threats/cve-2026-82073-mongodb-server-aggregation-framework-privilege-escalation"},{"cve":"CVE-2026-82071","cvss":8.1,"epss":0.0054,"slug":"cve-2026-82071-mongodb-server-out-of-bounds-memory-write-in-storage-engine","title":"MongoDB Server out-of-bounds memory write in storage engine configuration","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:36.14+00:00","url":"https://junglewise.ai/threats/cve-2026-82071-mongodb-server-out-of-bounds-memory-write-in-storage-engine"},{"cve":"CVE-2026-82069","cvss":2.7,"epss":0.0041,"slug":"cve-2026-82069-mongodb-server-query-statistics-serialization-information","title":"MongoDB Server query statistics serialization information disclosure","severity":"low","exploited":false,"published_at":"2026-09-08T17:18:35.877+00:00","url":"https://junglewise.ai/threats/cve-2026-82069-mongodb-server-query-statistics-serialization-information"},{"cve":"CVE-2026-82062","cvss":5.5,"epss":0.0045,"slug":"cve-2026-82062-mongodb-server-feature-gate-bypass-in-applyops-command","title":"MongoDB Server feature gate bypass in applyOps command","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:34.97+00:00","url":"https://junglewise.ai/threats/cve-2026-82062-mongodb-server-feature-gate-bypass-in-applyops-command"},{"cve":"CVE-2026-82061","cvss":8.1,"epss":0.0053,"slug":"cve-2026-82061-mongodb-server-use-after-free-in-query-execution-memory-tracking","title":"MongoDB Server use-after-free in query execution memory tracking","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:34.837+00:00","url":"https://junglewise.ai/threats/cve-2026-82061-mongodb-server-use-after-free-in-query-execution-memory-tracking"},{"cve":"CVE-2026-82057","cvss":6.5,"epss":0.0042,"slug":"cve-2026-82057-mongodb-readwrite-privilege-dos-via-wiredtiger-misconfiguration","title":"MongoDB readWrite privilege DoS via WiredTiger misconfiguration","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:34.287+00:00","url":"https://junglewise.ai/threats/cve-2026-82057-mongodb-readwrite-privilege-dos-via-wiredtiger-misconfiguration"},{"cve":"CVE-2026-82055","cvss":6.5,"epss":0.004,"slug":"cve-2026-82055-mongodb-null-pointer-dereference-in-2dsphere-index","title":"MongoDB null pointer dereference in 2dsphere index","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:33.41+00:00","url":"https://junglewise.ai/threats/cve-2026-82055-mongodb-null-pointer-dereference-in-2dsphere-index"},{"cve":"CVE-2026-84967","cvss":4.3,"epss":0.0027,"slug":"cve-2026-84967-mongodb-extension-for-visual-studio-code-command-injection-in","title":"MongoDB extension for Visual Studio Code command injection in connection string","severity":"medium","exploited":false,"published_at":"2026-09-03T16:18:25.703+00:00","url":"https://junglewise.ai/threats/cve-2026-84967-mongodb-extension-for-visual-studio-code-command-injection-in"},{"cve":"CVE-2026-18704","cvss":6.5,"epss":0.002,"slug":"cve-2026-18704-mongodb-server-privilege-escalation-in-aggregation-framework","title":"MongoDB Server privilege escalation in aggregation framework","severity":"medium","exploited":false,"published_at":"2026-08-11T19:17:25.05+00:00","url":"https://junglewise.ai/threats/cve-2026-18704-mongodb-server-privilege-escalation-in-aggregation-framework"},{"cve":"CVE-2026-8063","cvss":6.5,"slug":"cve-2026-8063-mongodb-server-null-pointer-dereference-in-rankfusion-and","title":"MongoDB Server NULL pointer dereference in $rankFusion and $scoreFusion","severity":"medium","exploited":false,"published_at":"2026-05-07T06:16:05.723+00:00","url":"https://junglewise.ai/threats/cve-2026-8063-mongodb-server-null-pointer-dereference-in-rankfusion-and"},{"cve":"CVE-2025-14847","cvss":8.7,"epss":0.6894,"slug":"cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib","title":"MongoDB Server uninitialized heap memory disclosure in Zlib headers","severity":"critical","exploited":true,"published_at":"2025-12-29T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"MongoDB Server","slug":"mongodb-server","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/mongodb-server"},{"name":"MongoDB C Driver","slug":"c-driver","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/c-driver"},{"name":"MongoDB Connector for BI","slug":"connector-for-bi","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/connector-for-bi"},{"name":"MongoDB Bi Connector Odbc Driver","slug":"bi-connector-odbc-driver","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/bi-connector-odbc-driver"},{"name":"MongoDB Mongo-Express","slug":"mongo-express","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/mongo-express"},{"name":"MongoDB Compass","slug":"compass","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/compass"},{"name":"MongoDB Entity Framework Core Provider","slug":"entity-framework-core-provider","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/entity-framework-core-provider"},{"name":"MongoDB Go Driver","slug":"go-driver","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/go-driver"},{"name":"MongoDB Java Driver","slug":"java-driver","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/java-driver"},{"name":"MongoDB Libmongocrypt","slug":"libmongocrypt","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/libmongocrypt"},{"name":"MongoDB Mongosql Transition Readiness Tool","slug":"mongosql-transition-readiness-tool","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/mongosql-transition-readiness-tool"},{"name":"MongoDB PHP Driver","slug":"php-driver","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/php-driver"}],"technology":{"hub":true,"name":"MongoDB","slug":"mongodb","vendor":{"name":"MongoDB","slug":"mongodb","url":"https://junglewise.ai/threats/vendors/mongodb"},"aliases":[],"category":"database","homepage":"https://www.mongodb.com/","repo_url":"https://github.com/mongodb/mongo","description":"A document-oriented NoSQL database program that uses JSON-like documents with optional schemas.","url":"https://junglewise.ai/threats/technologies/mongodb"},"most_severe":[{"cve":"CVE-2025-14847","cvss":8.7,"epss":0.6894,"slug":"cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib","title":"MongoDB Server uninitialized heap memory disclosure in Zlib headers","severity":"critical","exploited":true,"published_at":"2025-12-29T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib"},{"cve":"CVE-2026-82071","cvss":8.1,"epss":0.0054,"slug":"cve-2026-82071-mongodb-server-out-of-bounds-memory-write-in-storage-engine","title":"MongoDB Server out-of-bounds memory write in storage engine configuration","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:36.14+00:00","url":"https://junglewise.ai/threats/cve-2026-82071-mongodb-server-out-of-bounds-memory-write-in-storage-engine"},{"cve":"CVE-2026-82061","cvss":8.1,"epss":0.0053,"slug":"cve-2026-82061-mongodb-server-use-after-free-in-query-execution-memory-tracking","title":"MongoDB Server use-after-free in query execution memory tracking","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:34.837+00:00","url":"https://junglewise.ai/threats/cve-2026-82061-mongodb-server-use-after-free-in-query-execution-memory-tracking"},{"cve":"CVE-2026-82075","cvss":7.5,"epss":0.0052,"slug":"cve-2026-82075-mongodb-mongos-uncontrolled-resource-consumption","title":"MongoDB mongos uncontrolled resource consumption","severity":"high","exploited":false,"published_at":"2026-09-08T17:18:36.53+00:00","url":"https://junglewise.ai/threats/cve-2026-82075-mongodb-mongos-uncontrolled-resource-consumption"},{"cve":"CVE-2026-82057","cvss":6.5,"epss":0.0042,"slug":"cve-2026-82057-mongodb-readwrite-privilege-dos-via-wiredtiger-misconfiguration","title":"MongoDB readWrite privilege DoS via WiredTiger misconfiguration","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:34.287+00:00","url":"https://junglewise.ai/threats/cve-2026-82057-mongodb-readwrite-privilege-dos-via-wiredtiger-misconfiguration"},{"cve":"CVE-2026-82055","cvss":6.5,"epss":0.004,"slug":"cve-2026-82055-mongodb-null-pointer-dereference-in-2dsphere-index","title":"MongoDB null pointer dereference in 2dsphere index","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:33.41+00:00","url":"https://junglewise.ai/threats/cve-2026-82055-mongodb-null-pointer-dereference-in-2dsphere-index"},{"cve":"CVE-2026-82073","cvss":6.5,"epss":0.0033,"slug":"cve-2026-82073-mongodb-server-aggregation-framework-privilege-escalation","title":"MongoDB Server aggregation framework privilege escalation","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:36.273+00:00","url":"https://junglewise.ai/threats/cve-2026-82073-mongodb-server-aggregation-framework-privilege-escalation"},{"cve":"CVE-2026-18704","cvss":6.5,"epss":0.002,"slug":"cve-2026-18704-mongodb-server-privilege-escalation-in-aggregation-framework","title":"MongoDB Server privilege escalation in aggregation framework","severity":"medium","exploited":false,"published_at":"2026-08-11T19:17:25.05+00:00","url":"https://junglewise.ai/threats/cve-2026-18704-mongodb-server-privilege-escalation-in-aggregation-framework"},{"cve":"CVE-2026-8063","cvss":6.5,"slug":"cve-2026-8063-mongodb-server-null-pointer-dereference-in-rankfusion-and","title":"MongoDB Server NULL pointer dereference in $rankFusion and $scoreFusion","severity":"medium","exploited":false,"published_at":"2026-05-07T06:16:05.723+00:00","url":"https://junglewise.ai/threats/cve-2026-8063-mongodb-server-null-pointer-dereference-in-rankfusion-and"},{"cve":"CVE-2026-82062","cvss":5.5,"epss":0.0045,"slug":"cve-2026-82062-mongodb-server-feature-gate-bypass-in-applyops-command","title":"MongoDB Server feature gate bypass in applyOps command","severity":"medium","exploited":false,"published_at":"2026-09-08T17:18:34.97+00:00","url":"https://junglewise.ai/threats/cve-2026-82062-mongodb-server-feature-gate-bypass-in-applyops-command"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}