M
Vendor security profile2 actively exploited CVEs
mongodb
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs196
Critical4
CISA KEV2
Public exploit2
Patch rate%11
Avg. CVSS6.7
12-month vulnerability rate
1
2
0
0
0
0
5
14
26
55
71
17
CVE KEV
CVE severity distribution
196toplam CVE
Critical4 (2%)
High77 (39%)
Medium107 (55%)
Low6 (3%)
Uncertain2 (1%)
Patch and exploitation view
%11
Verified patch
%1
CISA KEV
%1
Public exploit
21Patch available
0Partial
2Workaround
0Vendor: no patch
173Unknown
Latest vulnerabilities
6.0
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
M
Patch status unknownEPSS %0
2.3
CVE-2026-87108
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
M
Patch status unknownEPSS %0
6.9
CVE-2026-87110
Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
M
Patch status unknownEPSS %0
5.9
CVE-2026-106435
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
M
Patch status unknownEPSS %0
6.3
CVE-2026-106436
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
M
Patch status unknownEPSS %0
2.0
CVE-2026-106432
Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
M
Patch status unknownEPSS %0
8.2
CVE-2026-107325
Application denial of service via missing BSON array length validation in MongoDB Go Driver
M
Patch status unknownEPSS %0
8.2
CVE-2026-107324
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
M
Patch status unknownEPSS %0
5.3
CVE-2026-106434
Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
M
Patch status unknownEPSS %0
8.7
CVE-2026-106433
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
M
Patch status unknownEPSS %0