MongoDB Atlas CVEs

277 vulnerabilities mapped to MongoDB Atlas’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

MongoDB Atlas CVEs per week, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-09-18
CVE-2026-93764 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
CVSS 6.5 mediumEPSS 0.15%
2026-09-18
CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
CVSS 9.1 criticalEPSS 0.51%
2026-09-18
CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
CVSS 8.1 highEPSS 0.36%
2026-09-17
CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
CVSS 5.3 mediumEPSS 0.40%
2026-09-17
CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass
CVSS 3.7 lowEPSS 0.32%
2026-09-17
CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
CVSS 8.1 highEPSS 0.47%
2026-09-17
CVE-2026-92757 Malformed connection string may disable field level encryption
CVSS 5.5 mediumEPSS 0.07%
2026-09-17
CVE-2026-92758 Logs may collect sensitive information
CVSS 5.5 mediumEPSS 0.15%
2026-09-17
CVE-2026-92756 Combining encryption settings may disable encryption
CVSS 5.5 mediumEPSS 0.07%
2026-09-11
CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
CVSS 7.5 highEPSS 0.32%
2026-09-10
CVE-2026-88036 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
CVSS 8.3 highEPSS 0.26%
2026-09-10
CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
CVSS 4.7 mediumEPSS 0.10%
2026-09-10
CVE-2026-88034 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
CVSS 8.3 highEPSS 0.46%
2026-09-10
CVE-2026-88033 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver
CVSS 8.3 highEPSS 0.46%
2026-09-10
CVE-2026-88032 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
CVSS 5.9 mediumEPSS 0.26%
2026-09-10
CVE-2026-88031 GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
CVSS 8.1 highEPSS 0.48%
2026-09-10
CVE-2026-88030 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
CVSS 8.3 highEPSS 0.26%
2026-09-10
CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
CVSS 8.3 highEPSS 0.26%
2026-09-10
CVE-2026-88028 Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel
CVSS 6.5 mediumEPSS 0.42%
2026-09-10
CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel
CVSS 7.1 highEPSS 0.27%
2026-09-10
CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
CVSS 6.5 mediumEPSS 0.38%
2026-09-10
CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver
CVSS 8.3 highEPSS 0.48%
2026-09-10
CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
CVSS 8.3 highEPSS 0.48%
2026-09-10
CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
CVSS 8.3 highEPSS 0.33%
2026-09-10
CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel
CVSS 7.7 highEPSS 0.43%
2026-09-08
CVE-2026-82076 Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
CVSS 6.5 mediumEPSS 0.41%
2026-09-08
CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
CVSS 7.5 highEPSS 0.52%
2026-09-08
CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
CVSS 6.5 mediumEPSS 0.36%
2026-09-08
CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search
CVSS 6.5 mediumEPSS 0.36%
2026-09-08
CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
CVSS 8.1 highEPSS 0.54%
2026-09-08
CVE-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
CVSS 6.5 mediumEPSS 0.33%
2026-09-08
CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
CVSS 2.7 lowEPSS 0.41%
2026-09-08
CVE-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
CVSS 6.5 mediumEPSS 0.40%
2026-09-08
CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
CVSS 8.1 highEPSS 0.50%
2026-09-08
CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component
CVSS 4.3 mediumEPSS 0.39%
2026-09-08
CVE-2026-82065 Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
CVSS 6.5 mediumEPSS 0.40%
2026-09-08
CVE-2026-82064 Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
CVSS 7.5 highEPSS 0.52%
2026-09-08
CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service
CVSS 5.3 mediumEPSS 0.37%
2026-09-08
CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass
CVSS 5.5 mediumEPSS 0.45%
2026-09-08
CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
CVSS 8.1 highEPSS 0.52%
2026-09-08
CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
CVSS 5.4 mediumEPSS 0.34%
2026-09-08
CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
CVSS 5.3 mediumEPSS 0.37%
2026-09-08
CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
CVSS 6.5 mediumEPSS 0.40%
2026-09-08
CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-09-08
CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
CVSS 5.3 mediumEPSS 0.33%
2026-09-08
CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
CVSS 6.5 mediumEPSS 0.40%
2026-09-08
CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
CVSS 6.5 mediumEPSS 0.40%
2026-09-08
CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
CVSS 8.1 highEPSS 0.41%
2026-09-08
CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
CVSS 6.5 mediumEPSS 0.50%
2026-09-03
CVE-2026-84968 Heap out-of-bounds read via corrupt nested BSON in field path error message
CVSS 5.3 mediumEPSS 0.20%

All vendors’ CVEs · JSON · Markdown