M
Vendor security profile2 actively exploited CVEs
mongodb
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs201
Critical4
CISA KEV2
Public exploit2
Patch rate%12
Avg. CVSS6.6
12-month vulnerability rate
1
2
0
0
0
0
5
14
26
55
71
22
CVE KEV
CVE severity distribution
201toplam CVE
Critical4 (2%)
High80 (40%)
Medium109 (54%)
Low6 (3%)
Uncertain2 (1%)
Patch and exploitation view
%12
Verified patch
%1
CISA KEV
%1
Public exploit
24Patch available
0Partial
2Workaround
0Vendor: no patch
175Unknown
Latest vulnerabilities
7.1
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
M
Patch status unknown
7.1
CVE-2026-104004
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
M
Patch status unknown
5.3
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread as field references
M
Patch status unknown
7.1
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
M
Patch status unknown
6.0
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
M
Patch status unknown
6.0
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
M
Patch status unknownEPSS %0
2.3
CVE-2026-87108
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
M
Patch status unknownEPSS %0
6.9
CVE-2026-87110
Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
M
Patch status unknownEPSS %0
5.9
CVE-2026-106435
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
M
Patch status unknownEPSS %0
6.3
CVE-2026-106436
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
M
Patch status unknownEPSS %0