CVEs for MongoDB Atlas
277 matching vulnerabilities, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-9747 Crafted cross-shard merge aggregation crashes MongoDB Server
CVSS 6.5 mediumEPSS 0.27%MongoDB Atlas
CVE-2026-9746 Server crashes in case of the use of exchange
CVSS 6.5 mediumEPSS 0.27%MongoDB Atlas
CVE-2026-9743 Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
CVSS 6.5 mediumEPSS 0.31%MongoDB Atlas
CVE-2026-9741 Client side encryption fails to encrypt values in a $vectorSearch
CVSS 6.5 mediumEPSS 0.10%MongoDB Atlas
CVE-2026-9101 Prototype pollution in csv parsing
CVSS 4.3 mediumEPSS 0.41%MongoDB Atlas
CVE-2026-9100 Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
CVSS 5.9 mediumEPSS 0.30%MongoDB Atlas
CVE-2026-8843 Calling createIndex with certain index types can crash mongod
CVSS 6.5 mediumEPSS 0.24%MongoDB Atlas
CVE-2026-6811 PHP Stack Exhaustion
CVSS 5.9 mediumEPSS 0.37%MongoDB Atlas
CVE-2026-8202 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
CVSS 4.3 mediumEPSS 0.26%MongoDB Atlas
CVE-2026-8200 Schema validation log messages may not redact user data
CVSS 2.7 lowEPSS 0.20%MongoDB Atlas
CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions
CVSS 6.5 mediumEPSS 0.26%MongoDB Atlas
CVE-2026-8053 FlatBSON Duplicate Field Index Drift
CVSS 8.8 highEPSS 0.66%MongoDB Atlas
CVE-2026-8431 Ops Manager RCE via webhook body
CVSS 7.2 highEPSS 0.37%MongoDB Atlas
CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
CVSS 7.8 highEPSS 0.13%MongoDB Atlas
CVE-2026-6915 Flaw in the updateUser Command May Allow Unauthorized Configuration Change
CVSS 6.3 mediumEPSS 0.17%MongoDB Atlas
CVE-2026-6914 MD5 checksum creation may cause availability loss
CVSS 6.5 mediumEPSS 0.26%MongoDB Atlas
CVE-2026-6231 bson_validate may skip validation when processing certain inputs
CVSS 4.3 mediumEPSS 0.18%MongoDB Atlas
CVE-2026-5170 Users could trigger a crash of mongod primaries during promotion to sharded
CVSS 5.3 mediumEPSS 0.20%MongoDB Atlas
CVE-2026-4358 Memory safety issues in slot-based execution hash table spill
CVSS 6.4 mediumEPSS 0.36%MongoDB Atlas
CVE-2026-4147 Stack memory disclosure in filemd5 command
CVSS 6.5 mediumEPSS 0.22%MongoDB Atlas
CVE-2026-2302 Unsafe Reflection in Mongoid::Criteria.from_hash
CVSS 6.5 mediumEPSS 0.23%MongoDB Atlas
CVE-2026-25609 profile command may permit unauthorized configuration
CVSS 5.4 mediumEPSS 0.20%MongoDB Atlas
CVE-2026-25610 Invalid $geoNear index hint may cause server crash
CVSS 6.5 mediumEPSS 0.28%MongoDB Atlas
CVE-2026-1847 MongoDB Server may crash when inserting large documents
CVSS 6.5 mediumEPSS 0.28%MongoDB Atlas
CVE-2026-25612 Internal ResourceId collision may affect unrelated collections
CVSS 6.5 mediumEPSS 0.23%MongoDB Atlas
CVE-2025-14911 Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure
CVSS 6.5 mediumEPSS 0.33%MongoDB Atlas
CVE-2025-14847 Zlib compressed protocol header length confusion may allow memory read
CVSS 7.5 highKEV added EPSS 83.2%MongoDB Atlas1 incident
CVE-2025-13644 MongoDB may be susceptible to Invariant Failure due to batched delete
CVSS 6.5 mediumEPSS 0.33%MongoDB Atlas
CVE-2025-13507 Time-series operations may cause internal BSON size limit to be exceed
CVSS 6.5 mediumEPSS 0.29%MongoDB Atlas
CVE-2025-12119 Bulk write with options may read invalid memory
CVSS 6.8 mediumEPSS 0.21%MongoDB Atlas
CVE-2025-12657 Malformed KMIP response may result in access violation
CVSS 5.0 mediumEPSS 0.39%MongoDB Atlas
CVE-2025-11695 Configuration may unexpectedly disable certificate validation
CVSS 8.0 highEPSS 0.18%MongoDB Atlas
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)