# MongoDB C Driver. Every CVE that names MongoDB C Driver among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views](https://agentprime.io/advisories/CVE-2026-120954.md) `CVE-2026-120954` · CVE record: MongoDB C Driver · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata](https://agentprime.io/advisories/CVE-2026-120955.md) `CVE-2026-120955` · CVE record: MongoDB C Driver · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [remote abort and memory disclosure from a malformed cursor.ns](https://agentprime.io/advisories/CVE-2026-120956.md) `CVE-2026-120956` · CVE record: MongoDB C Driver · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password](https://agentprime.io/advisories/CVE-2026-120684.md) `CVE-2026-120684` · CVE record: MongoDB C Driver · CVSS 6.0 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)](https://agentprime.io/advisories/CVE-2026-120678.md) `CVE-2026-120678` · CVE record: MongoDB C Driver · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service - [BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards](https://agentprime.io/advisories/CVE-2026-114654.md) `CVE-2026-114654` · CVE record: MongoDB C# Driver · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-681 - [Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder](https://agentprime.io/advisories/CVE-2026-114653.md) `CVE-2026-114653` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-185 - [Update operator injection via single-element list rewriting in the update builder](https://agentprime.io/advisories/CVE-2026-114652.md) `CVE-2026-114652` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Other injection - [Cross-document data leak via malformed BSON array parsing in reused thread buffer](https://agentprime.io/advisories/CVE-2026-114651.md) `CVE-2026-114651` · CVE record: MongoDB C# Driver · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption - [Plaintext exposure of encrypted fields via ANSI code-page corruption of database name](https://agentprime.io/advisories/CVE-2026-114650.md) `CVE-2026-114650` · CVE record: MongoDB C# Driver and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-838 - [Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache](https://agentprime.io/advisories/CVE-2026-114649.md) `CVE-2026-114649` · CVE record: MongoDB C# Driver · CVSS 7.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-1025 - [NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys](https://agentprime.io/advisories/CVE-2026-114648.md) `CVE-2026-114648` · CVE record: MongoDB C# Driver · CVSS 7.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Other injection - [NoSQL operator injection via unvalidated replacement document in findOneAndReplace](https://agentprime.io/advisories/CVE-2026-114647.md) `CVE-2026-114647` · CVE record: MongoDB C# Driver · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Other injection - [NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire](https://agentprime.io/advisories/CVE-2026-114646.md) `CVE-2026-114646` · CVE record: MongoDB C# Driver · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-130 - [Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping](https://agentprime.io/advisories/CVE-2026-114645.md) `CVE-2026-114645` · CVE record: MongoDB C Driver · CVSS 5.7 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption - [Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization](https://agentprime.io/advisories/CVE-2026-114644.md) `CVE-2026-114644` · CVE record: MongoDB C# Driver · CVSS 8.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Denial of service - [Duplicate geometry fields via unvalidated GeoJSON extra members](https://agentprime.io/advisories/CVE-2026-114643.md) `CVE-2026-114643` · CVE record: MongoDB C# Driver · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-694 - [Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver](https://agentprime.io/advisories/CVE-2026-106430.md) `CVE-2026-106430` · CVE record: MongoDB C++ Driver · CVSS 6.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-436 - [Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-106438.md) `CVE-2026-106438` · CVE record: MongoDB C Driver · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-682 - [Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-106437.md) `CVE-2026-106437` · CVE record: MongoDB C Driver · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption - [One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-106431.md) `CVE-2026-106431` · CVE record: MongoDB C Driver · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption - [Out-of-bounds read in SCRAM response parsing in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-106428.md) `CVE-2026-106428` · CVE record: MongoDB C Driver · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption - [Heap buffer overflow via mid-scan command list growth in client topology monitoring](https://agentprime.io/advisories/CVE-2026-96746.md) `CVE-2026-96746` · CVE record: MongoDB C Driver · CVSS 8.3 High · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-88036.md) `CVE-2026-88036` · CVE record: MongoDB C Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-88035.md) `CVE-2026-88035` · CVE record: MongoDB C Driver · CVSS 5.7 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Memory corruption - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver](https://agentprime.io/advisories/CVE-2026-88034.md) `CVE-2026-88034` · CVE record: MongoDB C++ Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver](https://agentprime.io/advisories/CVE-2026-88026.md) `CVE-2026-88026` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver](https://agentprime.io/advisories/CVE-2026-88025.md) `CVE-2026-88025` · CVE record: MongoDB C# Driver · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Other injection - [Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser](https://agentprime.io/advisories/CVE-2026-84963.md) `CVE-2026-84963` · CVE record: MongoDB C Driver · CVSS 6.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-681 - [Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client](https://agentprime.io/advisories/CVE-2026-84964.md) `CVE-2026-84964` · CVE record: MongoDB C Driver · CVSS 8.2 High · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption - [Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds](https://agentprime.io/advisories/CVE-2026-84965.md) `CVE-2026-84965` · CVE record: MongoDB C Driver · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption - [BSON element injection via NUL-embedded document keys in builder append](https://agentprime.io/advisories/CVE-2026-84966.md) `CVE-2026-84966` · CVE record: MongoDB C++ Driver · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-681 - [Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output](https://agentprime.io/advisories/CVE-2026-84969.md) `CVE-2026-84969` · CVE record: MongoDB C Driver · CVSS 6.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption - [Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser](https://agentprime.io/advisories/CVE-2026-84970.md) `CVE-2026-84970` · CVE record: MongoDB C++ Driver · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-681 - [KMS master key exposure via unredacted credential serialization in driver settings string](https://agentprime.io/advisories/CVE-2026-81530.md) `CVE-2026-81530` · CVE record: MongoDB C# Driver · CVSS 6.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Information disclosure - [Connection-option injection via unescaped settings in the canonical MongoDB URL builder](https://agentprime.io/advisories/CVE-2026-81529.md) `CVE-2026-81529` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Command injection - [NoSQL injection via array replacement bypassing update shape validation in driver write path](https://agentprime.io/advisories/CVE-2026-81528.md) `CVE-2026-81528` · CVE record: MongoDB C# Driver · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation](https://agentprime.io/advisories/CVE-2026-81527.md) `CVE-2026-81527` · CVE record: MongoDB C# Driver · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Other injection - [Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver](https://agentprime.io/advisories/CVE-2026-81524.md) `CVE-2026-81524` · CVE record: MongoDB C Driver · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-99 - [Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver](https://agentprime.io/advisories/CVE-2026-81522.md) `CVE-2026-81522` · CVE record: MongoDB C++ Driver · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-116 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .