| CVE-2026-82067 | 9.2 | 2026-09-08 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled s… |
| CVE-2026-18691 | 9.0 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one… |
| CVE-2026-82075 | 8.7 | 2026-09-08 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a ro… |
| CVE-2026-82064 | 8.7 | 2026-09-08 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an a… |
| CVE-2026-18697 | 8.7 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a spec… |
| CVE-2026-89099 | 7.7 | 2026-09-11 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leadin… |
| CVE-2026-18692 | 7.7 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used af… |
| CVE-2026-82053 | 7.6 | 2026-09-08 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication un… |
| CVE-2026-18712 | 7.2 | 2026-08-11 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthori… |
| CVE-2026-18693 | 7.2 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inc… |
| CVE-2026-18690 | 7.2 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their ass… |
| CVE-2026-82076 | 7.1 | 2026-09-08 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an int… |
| CVE-2026-82074 | 7.1 | 2026-09-08 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially format… |
| CVE-2026-82070 | 7.1 | 2026-09-08 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credential… |
| CVE-2026-82068 | 7.1 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryabl… |
| CVE-2026-82065 | 7.1 | 2026-09-08 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial o… |
| CVE-2026-82058 | 7.1 | 2026-09-08 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document … |
| CVE-2026-82054 | 7.1 | 2026-09-08 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSc… |
| CVE-2026-82052 | 7.1 | 2026-09-08 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific cond… |
| CVE-2026-18711 | 7.1 | 2026-08-11 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the … |
| CVE-2026-18705 | 7.1 | 2026-08-11 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected… |
| CVE-2026-18701 | 7.1 | 2026-08-11 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a… |
| CVE-2026-18695 | 7.1 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to… |
| CVE-2026-18694 | 7.1 | 2026-08-11 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored an… |
| CVE-2026-18688 | 7.1 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric para… |
| CVE-2026-18687 | 7.1 | 2026-08-11 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field c… |
| CVE-2026-18696 | 7.0 | 2026-08-11 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such … |
| CVE-2026-82063 | 6.0 | 2026-09-08 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing con… |
| CVE-2026-82059 | 6.0 | 2026-09-08 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster … |
| CVE-2026-82056 | 6.0 | 2026-09-08 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifec… |
| CVE-2026-18700 | 6.0 | 2026-08-11 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying… |
| CVE-2026-18699 | 6.0 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitti… |
| CVE-2026-18709 | 5.9 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, byp… |
| CVE-2026-82066 | 5.3 | 2026-09-08 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trig… |
| CVE-2026-18708 | 5.3 | 2026-08-11 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the que… |
| CVE-2026-18707 | 5.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitt… |
| CVE-2026-18702 | 5.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server… |
| CVE-2026-18698 | 5.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should re… |
| CVE-2026-82060 | 2.3 | 2026-09-08 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped … |