cna@mongodb.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cna@mongodb.com
03
assessed vulnerabilities (338)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115930US | — | — | ||
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermedi… | ||||
| CVE-2026-115929US | — | — | ||
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA c… | ||||
| CVE-2026-114655US | — | — | ||
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses in… | ||||
| CVE-2026-114654US | — | — | ||
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass… | ||||
| CVE-2026-114653US | — | — | ||
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression… | ||||
| CVE-2026-114652US | — | — | ||
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/… | ||||
| CVE-2026-114651US | — | — | ||
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially c… | ||||
| CVE-2026-114650US | — | — | ||
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under… | ||||
| CVE-2026-114649US | — | — | ||
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creat… | ||||
| CVE-2026-114648US | — | — | ||
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the f… | ||||
| CVE-2026-114647US | — | — | ||
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An applicati… | ||||
| CVE-2026-114646US | — | — | ||
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from ex… | ||||
| CVE-2026-114645US | — | — | ||
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long cr… | ||||
| CVE-2026-114644US | — | — | ||
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes… | ||||
| CVE-2026-114643US | — | — | ||
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that plac… | ||||
| CVE-2026-113870US | — | Exploit | ||
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment conta… | ||||
| CVE-2026-112368US | — | — | ||
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decode… | ||||
| CVE-2026-96299US | — | — | ||
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a sp… | ||||
| CVE-2026-96297US | — | — | ||
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage… | ||||
| CVE-2026-104005US | — | — | ||
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a sp… | ||||