MongoDB
by MongoDB
Source repositories
CVEs (138)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-2392 | Med | 0.42 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9;… | ||
| CVE-2018-20805 | Med | 0.42 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10. | ||
| CVE-2018-20804 | Med | 0.42 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13. | ||
| CVE-2018-20802 | Med | 0.42 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3. | ||
| CVE-2020-7926 | Med | 0.42 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected. | ||
| CVE-2020-7923 | Med | 0.42 | 6.5 | 0.01 | Aug 21, 2020 | A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2… | ||
| CVE-2026-13067 | Med | 0.41 | 6.3 | 0.00 | Jul 22, 2026 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected… | ||
| CVE-2026-6915 | Med | 0.41 | 6.3 | 0.00 | Apr 29, 2026 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account. | ||
| CVE-2026-9751 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. | ||
| CVE-2026-9735 | Med | 0.36 | 5.5 | 0.00 | Jun 9, 2026 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction. | ||
| CVE-2021-32039 | Med | 0.36 | 5.5 | 0.00 | Jan 20, 2022 | Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension… | ||
| CVE-2014-8180 | Med | 0.36 | 5.5 | 0.00 | Jun 6, 2017 | MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service. | ||
| CVE-2016-6494 | Med | 0.36 | 5.5 | 0.00 | Oct 3, 2016 | The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files. | ||
| CVE-2026-25609 | Med | 0.35 | 5.4 | 0.00 | Feb 10, 2026 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. | ||
| CVE-2024-6375 | Med | 0.35 | 5.4 | 0.00 | Jul 1, 2024 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server… | ||
| CVE-2021-32036 | Med | 0.35 | 5.4 | 0.01 | Feb 4, 2022 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field… | ||
| CVE-2021-20333 | Med | 0.35 | 5.3 | 0.01 | Jul 23, 2021 | Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2… | ||
| CVE-2019-20924 | Med | 0.35 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2. | ||
| CVE-2019-20923 | Med | 0.35 | 6.5 | 0.01 | Nov 23, 2020 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0… | ||
| CVE-2026-13070 | Med | 0.34 | 5.3 | 0.00 | Jul 22, 2026 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the… |
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9;…
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected.
- risk 0.42cvss 6.5epss 0.01
A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2…
- risk 0.41cvss 6.3epss 0.00
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected…
- risk 0.41cvss 6.3epss 0.00
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
- risk 0.36cvss 5.5epss 0.00
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
- risk 0.36cvss 5.5epss 0.00
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
- risk 0.36cvss 5.5epss 0.00
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension…
- risk 0.36cvss 5.5epss 0.00
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
- risk 0.36cvss 5.5epss 0.00
The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.
- risk 0.35cvss 5.4epss 0.00
Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.
- risk 0.35cvss 5.4epss 0.00
A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server…
- risk 0.35cvss 5.4epss 0.01
An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field…
- risk 0.35cvss 5.3epss 0.01
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2…
- risk 0.35cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.
- risk 0.35cvss 6.5epss 0.01
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0…
- risk 0.34cvss 5.3epss 0.00
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the…
Page 5 of 7