# MongoDB Atlas CVEs > MongoDB Atlas: 277 CVEs mapped to its software or packages (2 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/mongodb-atlas/cves Last updated: 2026-10-24T00:31:30Z 277 CVEs map to MongoDB Atlas (2 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that MongoDB Atlas’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-24 | [CVE-2026-115929](https://rewindex.com/cve/CVE-2026-115929.md) | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs | 6.8 medium | | | 2026-10-22 | [CVE-2026-114655](https://rewindex.com/cve/CVE-2026-114655.md) | KMS request injection via unsanitized key vault and provider values in libmongocrypt | 5.9 medium | | | 2026-10-22 | [CVE-2026-114654](https://rewindex.com/cve/CVE-2026-114654.md) | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards | 6.5 medium | | | 2026-10-22 | [CVE-2026-114653](https://rewindex.com/cve/CVE-2026-114653.md) | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder | 6.5 medium | | | 2026-10-22 | [CVE-2026-114652](https://rewindex.com/cve/CVE-2026-114652.md) | Update operator injection via single-element list rewriting in the update builder | 6.5 medium | | | 2026-10-22 | [CVE-2026-114651](https://rewindex.com/cve/CVE-2026-114651.md) | Cross-document data leak via malformed BSON array parsing in reused thread buffer | 4.0 medium | | | 2026-10-22 | [CVE-2026-114650](https://rewindex.com/cve/CVE-2026-114650.md) | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name | 5.9 medium | | | 2026-10-22 | [CVE-2026-114649](https://rewindex.com/cve/CVE-2026-114649.md) | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache | 6.8 medium | | | 2026-10-22 | [CVE-2026-114648](https://rewindex.com/cve/CVE-2026-114648.md) | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys | 7.6 high | | | 2026-10-22 | [CVE-2026-114647](https://rewindex.com/cve/CVE-2026-114647.md) | NoSQL operator injection via unvalidated replacement document in findOneAndReplace | 4.3 medium | | | 2026-10-22 | [CVE-2026-114646](https://rewindex.com/cve/CVE-2026-114646.md) | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire | 6.5 medium | | | 2026-10-22 | [CVE-2026-114645](https://rewindex.com/cve/CVE-2026-114645.md) | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping | 5.2 medium | | | 2026-10-22 | [CVE-2026-114644](https://rewindex.com/cve/CVE-2026-114644.md) | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization | 5.9 medium | | | 2026-10-22 | [CVE-2026-114643](https://rewindex.com/cve/CVE-2026-114643.md) | Duplicate geometry fields via unvalidated GeoJSON extra members | 5.4 medium | | | 2026-10-21 | [CVE-2026-113870](https://rewindex.com/cve/CVE-2026-113870.md) | Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing | 8.8 high | | | 2026-10-19 | [CVE-2026-112368](https://rewindex.com/cve/CVE-2026-112368.md) | Unbounded Recursion in phongo\_bson\_visit\_document/visit\_array: | 7.5 high | | | 2026-10-13 | [CVE-2026-104005](https://rewindex.com/cve/CVE-2026-104005.md) | Incorrect authorization in MongoDB Server router for bulk writes to system namespaces | 6.5 medium | | | 2026-10-13 | [CVE-2026-104004](https://rewindex.com/cve/CVE-2026-104004.md) | Collection validators using collation-accepting expressions can crash MongoDB Server on insert | 6.5 medium | | | 2026-10-13 | [CVE-2026-103965](https://rewindex.com/cve/CVE-2026-103965.md) | Fixed values in MongoDB Server $bucket stage may be misread as field references | 5.4 medium | | | 2026-10-13 | [CVE-2026-96299](https://rewindex.com/cve/CVE-2026-96299.md) | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service | 6.5 medium | | | 2026-10-13 | [CVE-2026-96297](https://rewindex.com/cve/CVE-2026-96297.md) | MongoDB Server may disclose process memory via a crafted \`$\_internalApplyOplogUpdate\` aggregation pipeline | 6.5 medium | | | 2026-10-09 | [CVE-2026-87109](https://rewindex.com/cve/CVE-2026-87109.md) | Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings | 5.3 medium | | | 2026-10-09 | [CVE-2026-87108](https://rewindex.com/cve/CVE-2026-87108.md) | Ops Manager Improper Authorization in Daily Host Monitoring Retrieval | 3.1 low | | | 2026-10-09 | [CVE-2026-87110](https://rewindex.com/cve/CVE-2026-87110.md) | Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints | 5.3 medium | | | 2026-10-08 | [CVE-2026-106435](https://rewindex.com/cve/CVE-2026-106435.md) | Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver | 5.1 medium | | | 2026-10-08 | [CVE-2026-106436](https://rewindex.com/cve/CVE-2026-106436.md) | Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver | 4.8 medium | | | 2026-10-08 | [CVE-2026-106432](https://rewindex.com/cve/CVE-2026-106432.md) | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver | 3.6 low | | | 2026-10-08 | [CVE-2026-107325](https://rewindex.com/cve/CVE-2026-107325.md) | Application denial of service via missing BSON array length validation in MongoDB Go Driver | 5.9 medium | | | 2026-10-08 | [CVE-2026-107324](https://rewindex.com/cve/CVE-2026-107324.md) | Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver | 5.9 medium | | | 2026-10-08 | [CVE-2026-106434](https://rewindex.com/cve/CVE-2026-106434.md) | Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt | 4.3 medium | | | 2026-10-08 | [CVE-2026-106433](https://rewindex.com/cve/CVE-2026-106433.md) | Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt | 8.8 high | | | 2026-10-08 | [CVE-2026-106429](https://rewindex.com/cve/CVE-2026-106429.md) | Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt | 6.5 medium | | | 2026-10-08 | [CVE-2026-106430](https://rewindex.com/cve/CVE-2026-106430.md) | Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver | 5.9 medium | | | 2026-10-08 | [CVE-2026-106438](https://rewindex.com/cve/CVE-2026-106438.md) | Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver | 4.0 medium | | | 2026-10-08 | [CVE-2026-106437](https://rewindex.com/cve/CVE-2026-106437.md) | Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver | 6.2 medium | | | 2026-10-08 | [CVE-2026-106431](https://rewindex.com/cve/CVE-2026-106431.md) | One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver | 5.7 medium | | | 2026-10-08 | [CVE-2026-106428](https://rewindex.com/cve/CVE-2026-106428.md) | Out-of-bounds read in SCRAM response parsing in MongoDB C Driver | 3.7 low | | | 2026-10-05 | [CVE-2026-103546](https://rewindex.com/cve/CVE-2026-103546.md) | Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator | 4.3 medium | | | 2026-09-24 | [CVE-2026-96749](https://rewindex.com/cve/CVE-2026-96749.md) | Heap out-of-bounds write via signed size overflow in BSON document encoding | 8.4 high | | | 2026-09-24 | [CVE-2026-96748](https://rewindex.com/cve/CVE-2026-96748.md) | Connection redirection via percent-encoded delimiter injection in connection string hosts | 6.5 medium | | | 2026-09-24 | [CVE-2026-96747](https://rewindex.com/cve/CVE-2026-96747.md) | Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption | 5.0 medium | | | 2026-09-24 | [CVE-2026-96745](https://rewindex.com/cve/CVE-2026-96745.md) | PHP object injection via unsuppressible \_\_pclass class inference in command monitoring events | 5.6 medium | | | 2026-09-24 | [CVE-2026-96746](https://rewindex.com/cve/CVE-2026-96746.md) | Heap buffer overflow via mid-scan command list growth in client topology monitoring | 6.5 medium | | | 2026-09-24 | [CVE-2026-96750](https://rewindex.com/cve/CVE-2026-96750.md) | Shell script injection via server-supplied database name in Open MongoDB shell | 7.1 high | | | 2026-09-24 | [CVE-2026-96744](https://rewindex.com/cve/CVE-2026-96744.md) | Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel | 7.1 high | | | 2026-09-18 | [CVE-2026-93759](https://rewindex.com/cve/CVE-2026-93759.md) | Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist | 8.6 high | | | 2026-09-18 | [CVE-2026-93760](https://rewindex.com/cve/CVE-2026-93760.md) | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard | 8.2 high | | | 2026-09-18 | [CVE-2026-93761](https://rewindex.com/cve/CVE-2026-93761.md) | Denial of service via unbounded regex matching in Mongoid's in-memory query matcher | 7.5 high | | | 2026-09-18 | [CVE-2026-93762](https://rewindex.com/cve/CVE-2026-93762.md) | Data deletion and attribute disclosure via field-name method injection in in-memory queries | 9.8 critical | | | 2026-09-18 | [CVE-2026-93763](https://rewindex.com/cve/CVE-2026-93763.md) | Silent plaintext persistence via unresolved callable database name in encryption schema map | 6.5 medium | | Next page: [page 2](https://rewindex.com/company/mongodb-atlas/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (MongoDB Atlas) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 3 | 1 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-12-15 | 0 | 1 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 2 | 9 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 1 | 2 | 1 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 2 | 0 | 0 | 0 | | 2026-05-04 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-05-11 | 0 | 3 | 4 | 1 | 0 | 0 | | 2026-05-18 | 0 | 0 | 3 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 4 | 11 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 5 | 21 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 1 | 13 | 18 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 10 | 13 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 9 | 1 | 0 | 0 | | 2026-09-07 | 0 | 18 | 21 | 1 | 0 | 0 | | 2026-09-14 | 2 | 5 | 6 | 1 | 0 | 0 | | 2026-09-21 | 0 | 3 | 4 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 1 | 13 | 3 | 0 | 0 | | 2026-10-12 | 0 | 0 | 5 | 0 | 0 | 0 | | 2026-10-19 | 0 | 3 | 13 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/mongodb-atlas/cves · Markdown: https://rewindex.com/company/mongodb-atlas/cves.md · JSON: https://rewindex.com/api/v1/companies/mongodb-atlas/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:14:04.042Z