# MongoDB Inc. MongoDB Server.

Every CVE that names MongoDB Inc. MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [User may trigger invariant when allowed to send commands directly to shards](https://agentprime.io/advisories/CVE-2021-32037.md)
  `CVE-2021-32037` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 24 Nov 2021 · Tags: Denial of service
- [Server log entry spoofing via newline injection](https://agentprime.io/advisories/CVE-2021-20333.md)
  `CVE-2021-20333` · CVE record: MongoDB Inc. MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2021 · Tags: Other injection
- [Specially crafted query may result in a denial of service of mongod](https://agentprime.io/advisories/CVE-2021-20326.md)
  `CVE-2021-20326` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 30 Apr 2021 · Tags: CWE-20
- [Invariant failure when explaining a find with a UUID](https://agentprime.io/advisories/CVE-2018-25004.md)
  `CVE-2018-25004` · CVE record: MongoDB Inc. MongoDB Server · CVSS 4.9 Medium · Not analysed yet · Published 1 Mar 2021 · Tags: CWE-20
- [Specially crafted regex query can cause DoS](https://agentprime.io/advisories/CVE-2020-7929.md)
  `CVE-2020-7929` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Mar 2021 · Tags: CWE-185
- [Denial of service via malformed network packet](https://agentprime.io/advisories/CVE-2019-20925.md)
  `CVE-2019-20925` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 24 Nov 2020 · Tags: CWE-839
- [Infinite loop in aggregation expression](https://agentprime.io/advisories/CVE-2018-20803.md)
  `CVE-2018-20803` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: Denial of service
- [Improper neutralization of null byte leads to read overrun](https://agentprime.io/advisories/CVE-2020-7928.md)
  `CVE-2020-7928` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-158
- [Crash while joining collections with $lookup](https://agentprime.io/advisories/CVE-2019-2393.md)
  `CVE-2019-2393` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: Memory corruption
- [Crash while handling internal Javascript exception types](https://agentprime.io/advisories/CVE-2019-20923.md)
  `CVE-2019-20923` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-749
- [Invariant in IndexBoundsBuilder](https://agentprime.io/advisories/CVE-2019-20924.md)
  `CVE-2019-20924` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-394
- [$mod can result in undefined behavior](https://agentprime.io/advisories/CVE-2019-2392.md)
  `CVE-2019-2392` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: Memory corruption
- [Invariant with $elemMatch](https://agentprime.io/advisories/CVE-2018-20805.md)
  `CVE-2018-20805` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: Denial of service
- [Post-auth queries on compound index may crash mongod](https://agentprime.io/advisories/CVE-2018-20802.md)
  `CVE-2018-20802` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-394
- [Invariant failure in applyOps](https://agentprime.io/advisories/CVE-2018-20804.md)
  `CVE-2018-20804` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-20
- [Specific query can cause a DoS against MongoDB Server](https://agentprime.io/advisories/CVE-2020-7926.md)
  `CVE-2020-7926` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-755
- [Denial of Service when processing malformed Role names](https://agentprime.io/advisories/CVE-2020-7925.md)
  `CVE-2020-7925` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-475
- [Specific GeoQuery can cause DoS against MongoDB Server](https://agentprime.io/advisories/CVE-2020-7923.md)
  `CVE-2020-7923` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2020 · Tags: CWE-755
- [Administrative action may disable enforcement of per-user IP whitelisting](https://agentprime.io/advisories/CVE-2020-7921.md)
  `CVE-2020-7921` · CVE record: MongoDB Inc. MongoDB Server · CVSS 4.6 Medium · Not analysed yet · Published 6 May 2020 · Tags: CWE-182
- [Process termination via PID file manipulation](https://agentprime.io/advisories/CVE-2019-2389.md)
  `CVE-2019-2389` · CVE record: MongoDB Inc. MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2019 · Tags: Broken access control
- [Code execution on Windows via OpenSSL engine injection](https://agentprime.io/advisories/CVE-2019-2390.md)
  `CVE-2019-2390` · CVE record: MongoDB Inc. MongoDB Server · CVSS 8.2 High · Not analysed yet · Published 30 Aug 2019 · Tags: Code injection
- [Authorization session conflation](https://agentprime.io/advisories/CVE-2019-2386.md)
  `CVE-2019-2386` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 6 Aug 2019 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/technology/mongodb-inc-mongodb-server.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mongodb-inc-mongodb-server&cursor=WyIyMDIxLTEyLTE1VDEyOjMwOjEwLjQwNTAwMFoiLCJDVkUtMjAyMS0yMDMzMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mongodb-inc-mongodb-server/?cursor=WyIyMDIxLTEyLTE1VDEyOjMwOjEwLjQwNTAwMFoiLCJDVkUtMjAyMS0yMDMzMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.