CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 174100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 174; Last two years
Critical: 0; CVSS 9.0 and above
High: 174; CVSS 7.0 to 8.9
Known exploited: 1; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 37 · September 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.1High
CVE-2026-18695 (opens in a new tab)
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18694 (opens in a new tab)
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.
MongoDB Atlas· Aug 11, 2026
7.2High
CVE-2026-18693 (opens in a new tab)
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.
MongoDB Atlas· Aug 11, 2026
7.7High
CVE-2026-18692 (opens in a new tab)
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
MongoDB Atlas· Aug 11, 2026
7.2High
CVE-2026-18690 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18688 (opens in a new tab)
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18687 (opens in a new tab)
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-9737 (opens in a new tab)
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.
MongoDB Atlas· Jul 22, 2026
8.4High
CVE-2026-14881 (opens in a new tab)
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13077 (opens in a new tab)
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13076 (opens in a new tab)
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13075 (opens in a new tab)
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13071 (opens in a new tab)
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13069 (opens in a new tab)
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
MongoDB Atlas· Jul 22, 2026
7.2High
CVE-2026-13067 (opens in a new tab)
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13066 (opens in a new tab)
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13065 (opens in a new tab)
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13064 (opens in a new tab)
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13062 (opens in a new tab)
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13060 (opens in a new tab)
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
MongoDB Atlas· Jul 22, 2026
8.6High
CVE-2026-13059 (opens in a new tab)
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13058 (opens in a new tab)
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13056 (opens in a new tab)
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
MongoDB Atlas· Jul 22, 2026
7.1High
CVE-2026-13055 (opens in a new tab)
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.
MongoDB Atlas· Jul 22, 2026
8.7High
CVE-2026-11933 (opens in a new tab)
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.
MongoDB Atlas· Jun 12, 2026
7.1High
CVE-2026-9754 (opens in a new tab)
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
MongoDB Atlas· Jun 9, 2026
7.2High
CVE-2026-9753 (opens in a new tab)
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9752 (opens in a new tab)
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9750 (opens in a new tab)
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9749 (opens in a new tab)
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9748 (opens in a new tab)
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9747 (opens in a new tab)
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9746 (opens in a new tab)
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9743 (opens in a new tab)
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.
MongoDB Atlas· Jun 9, 2026
8.2High
CVE-2026-9742 (opens in a new tab)
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-9741 (opens in a new tab)
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
MongoDB Atlas· Jun 9, 2026
8.7High
CVE-2026-9740 (opens in a new tab)
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
MongoDB Atlas· Jun 9, 2026
7.1High
CVE-2026-8843 (opens in a new tab)
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
MongoDB Atlas· May 18, 2026
7.7High
CVE-2026-8336 (opens in a new tab)
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
7.1High
CVE-2026-8199 (opens in a new tab)
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
8.7High
CVE-2026-8053 (opens in a new tab)
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.
MongoDB Atlas· May 13, 2026
7.1High
CVE-2026-8063 (opens in a new tab)
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server. This issue affects MongoDB Server 8.2 versions prior to 8.2.7.
MongoDB Atlas· May 7, 2026
8.6High
CVE-2026-6691 (opens in a new tab)
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
MongoDB Atlas· May 6, 2026
7.1High
CVE-2026-6914 (opens in a new tab)
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
MongoDB Atlas· Apr 29, 2026
8.7High
CVE-2026-4148 (opens in a new tab)
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.
MongoDB Atlas· Mar 17, 2026
7.1High
CVE-2026-4147 (opens in a new tab)
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
MongoDB Atlas· Mar 17, 2026
7.1High
CVE-2026-25613 (opens in a new tab)
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.
MongoDB Atlas· Feb 10, 2026
7.1High
CVE-2026-25610 (opens in a new tab)
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
MongoDB Atlas· Feb 10, 2026
7.1High
CVE-2026-1850 (opens in a new tab)
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.
MongoDB Atlas· Feb 10, 2026
7.1High
CVE-2026-1849 (opens in a new tab)
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
MongoDB Atlas· Feb 10, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.