Vendor
MongoDB vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 247 vulnerabilities in MongoDB: 32 in the last 7 days and 167 in the last 90 days, 6 of them critical and 2 exploited in the wild. The most recent, CVE-2026-126982, was published on 13 November 2026. 36 vulnerabilities in the last four weeks, up 9% on the four before (33). 0 critical against 2. 21 technologies have a page of their own.
- Last 7 days
- 32
- Last 90 days
- 167
- Critical, all time
- 6
- Exploited in the wild
- 2
About MongoDB
An American software company that develops and provides commercial support for the MongoDB database.
MongoDB technologies
- MongoDB Server86
- MongoDB C Driver41
- MongoDB25
- MongoDB Connector for BI8
- MongoDB Bi Connector Odbc Driver7
- MongoDB Mongoid7
- MongoDB PHP Driver7
- MongoDB Compass6
- MongoDB Libmongocrypt6
- MongoDB Python Driver6
- MongoDB Go Driver5
- MongoDB Mongo-Express5
- MongoDB Node.js Driver5
- MongoDB Rust Driver5
- MongoDB Entity Framework Core Provider4
- MongoDB Java Driver4
- MongoDB Ops Manager4
- MongoDB Database Tools3
- MongoDB Laravel MongoDB3
- MongoDB Mongosql Transition Readiness Tool3
- MongoDB PHP Library3
Latest MongoDB vulnerabilities
- CVE-2026-126982: MongoDB C# Driver BSON type allow-list bypasshighCVSS 7.5
- CVE-2026-126839: MongoDB BSON deserialization type-restriction bypassmediumCVSS 4.2
- CVE-2026-126792: libmongocrypt out-of-bounds write in key-management request buildermediumCVSS 4.7
- CVE-2026-126823: MongoDB JDBC driver code injection via shared temp locationhighCVSS 7
- CVE-2026-126838: MongoDB Rust Driver credential disclosure in diagnostic outputmediumCVSS 5.5
- CVE-2026-126837: MongoDB Node.js driver DNS SRV validation bypasshighCVSS 7.4
- CVE-2026-126835: MongoDB Node.js driver OIDC bearer token disclosure to unallowed hostsmediumCVSS 6.5
- CVE-2026-120828: MongoDB replica-set denial of service via unreclaimed wait recordshighCVSS 7.5
- CVE-2026-120825: MongoDB Server authorization bypass in aggregation pipelinemediumCVSS 6.5
- CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validationhighCVSS 8.8
- CVE-2026-120823: MongoDB Server missing authorization check in aggregation frameworkmediumCVSS 4.3
- CVE-2026-120822: MongoDB Server authorization bypass in applyOpsmediumCVSS 6.7
- CVE-2026-120821: MongoDB Server use-after-free in aggregation frameworkmediumCVSS 6.5
- CVE-2026-120820: MongoDB Server memory exhaustion in FLE2 operation statisticsmediumCVSS 4.3
- CVE-2026-120819: MongoDB Server memory disclosure in JavaScript executionmediumCVSS 4.3
- CVE-2026-120818: MongoDB Server use-after-free in server-side JavaScript aggregationhighCVSS 7.1
- CVE-2026-120817: MongoDB Server race condition in schema validationmediumCVSS 6.5
- CVE-2026-120816: MongoDB privilege escalation via change stream showSystemEventsmediumCVSS 4.3
- CVE-2026-118383: MongoDB Server use-after-free in replication catch-upcriticalCVSS 9
- CVE-2026-120815: MongoDB Server authorization bypass via localhost exceptionhighCVSS 8.4
- CVE-2026-120814: MongoDB Server privilege escalation in sharding subsystemhighCVSS 7.2
- CVE-2026-120813: MongoDB Server client-side field-level encryption schema parsing bypassmediumCVSS 5.9
- CVE-2026-120812: MongoDB Server denial of service in query processingmediumCVSS 6.5
- CVE-2026-120811: MongoDB Server use-after-free in query plan cachemediumCVSS 5.9
- CVE-2026-120810: MongoDB server denial of service in aggregation frameworkmediumCVSS 6.5
Most severe MongoDB vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-14847: MongoDB Server uninitialized heap memory disclosure in Zlib headerscriticalexploited in the wildCVSS 8.7EPSS 68.9%
- CVE-2019-10758: mongo-express remote code execution in index creationcriticalexploited in the wildCVSS 3.1EPSS 84.7%
- CVE-2026-93762: Mongoid unsafe reflection weakness in query path for embedded documentscriticalCVSS 9.8EPSS 0.6%
- CVE-2026-19001: MongoDB BI Connector ODBC Driver buffer overflow in metadata functionscriticalCVSS 9.8EPSS 0.5%
- CVE-2026-93765: Mongoid unsafe reflection in document persistence layercriticalCVSS 9.1EPSS 0.5%
- CVE-2026-118383: MongoDB Server use-after-free in replication catch-upcriticalCVSS 9
- CVE-2026-81532: MongoDB Connector for BI ODBC driver buffer overflow in cursor name handlinghighCVSS 8.8EPSS 0.5%
- CVE-2026-18691: MongoDB Server SASL mechanism downgrade in intra-cluster authenticationhighCVSS 8.8EPSS 0.4%
- CVE-2026-106433: MongoDB libmongocrypt state management memory corruptionhighCVSS 8.8EPSS 0.3%
- CVE-2026-8053: MongoDB Server out-of-bounds write in time-series collectionshighCVSS 8.8EPSS 0.1%
Vulnerabilities per week
36 vulnerabilities in the last four weeks, up 9% on the four before (33). 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 23 | 0 | |
| 31 Aug 2026 | 9 | 0 | |
| 7 Sep 2026 | 34 | 0 | |
| 14 Sep 2026 | 13 | 2 | |
| 21 Sep 2026 | 7 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 13 | 0 | |
| 12 Oct 2026 | 5 | 0 | |
| 19 Oct 2026 | 16 | 0 | |
| 26 Oct 2026 | 4 | 0 | |
| 2 Nov 2026 | 11 | 0 | |
| 9 Nov 2026 | 32 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many MongoDB vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/mongodb)<a href="https://junglewise.ai/threats/vendors/mongodb"><img src="https://junglewise.ai/threats/vendors/mongodb/badge.svg" alt="MongoDB vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/mongodb.json, and this page as text at https://junglewise.ai/threats/vendors/mongodb.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "MongoDB vulnerabilities", https://junglewise.ai/threats/vendors/mongodb, 13 November 2026.