# MongoDB Server.

Every CVE that names MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access](https://agentprime.io/advisories/CVE-2026-13060.md)
  `CVE-2026-13060` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage](https://agentprime.io/advisories/CVE-2026-13061.md)
  `CVE-2026-13061` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters](https://agentprime.io/advisories/CVE-2026-13062.md)
  `CVE-2026-13062` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-441
- [libmongocrypt Improper Input Validation Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13063.md)
  `CVE-2026-13063` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-13064.md)
  `CVE-2026-13064` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13065.md)
  `CVE-2026-13065` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure](https://agentprime.io/advisories/CVE-2026-13066.md)
  `CVE-2026-13066` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket](https://agentprime.io/advisories/CVE-2026-13067.md)
  `CVE-2026-13067` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse](https://agentprime.io/advisories/CVE-2026-13068.md)
  `CVE-2026-13068` · CVE record: MongoDB MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion](https://agentprime.io/advisories/CVE-2026-13069.md)
  `CVE-2026-13069` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13070.md)
  `CVE-2026-13070` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13071.md)
  `CVE-2026-13071` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption](https://agentprime.io/advisories/CVE-2026-13072.md)
  `CVE-2026-13072` · CVE record: MongoDB MongoDB Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13073.md)
  `CVE-2026-13073` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-13074.md)
  `CVE-2026-13074` · CVE record: MongoDB MongoDB Server · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation](https://agentprime.io/advisories/CVE-2026-13075.md)
  `CVE-2026-13075` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Aggregation Framework Memory Exhaustion Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13076.md)
  `CVE-2026-13076` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data](https://agentprime.io/advisories/CVE-2026-13077.md)
  `CVE-2026-13077` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader](https://agentprime.io/advisories/CVE-2026-13078.md)
  `CVE-2026-13078` · CVE record: MongoDB MongoDB Server · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow](https://agentprime.io/advisories/CVE-2026-9740.md)
  `CVE-2026-9740` · CVE record: MongoDB MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Keyfile contents are in MongoDB Server logs](https://agentprime.io/advisories/CVE-2026-9735.md)
  `CVE-2026-9735` · CVE record: MongoDB MongoDB Server · CVSS 6.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Information disclosure
- [Server crash via malformed binary diff passed to $\_internalApplyOplogUpdate.](https://agentprime.io/advisories/CVE-2026-9753.md)
  `CVE-2026-9753` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1287
- [GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation](https://agentprime.io/advisories/CVE-2026-9752.md)
  `CVE-2026-9752` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption
- [Sensitive data could be written to mongod.log](https://agentprime.io/advisories/CVE-2026-9751.md)
  `CVE-2026-9751` · CVE record: MongoDB MongoDB Server · CVSS 6.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Information disclosure
- [Metadata name collision on $-prefixed fields causes post-auth server crash](https://agentprime.io/advisories/CVE-2026-9750.md)
  `CVE-2026-9750` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Using MaxKey() may crash the server](https://agentprime.io/advisories/CVE-2026-9749.md)
  `CVE-2026-9749` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [$\_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input](https://agentprime.io/advisories/CVE-2026-9748.md)
  `CVE-2026-9748` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Crafted cross-shard merge aggregation crashes MongoDB Server](https://agentprime.io/advisories/CVE-2026-9747.md)
  `CVE-2026-9747` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Server crashes in case of the use of exchange](https://agentprime.io/advisories/CVE-2026-9746.md)
  `CVE-2026-9746` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Aggregation sub-pipeline null dereference may allow DoS via crafted getMore](https://agentprime.io/advisories/CVE-2026-9743.md)
  `CVE-2026-9743` · CVE record: MongoDB MongoDB server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption
- [Authenticate command with specific mechanism parameter can trigger server crash](https://agentprime.io/advisories/CVE-2026-9742.md)
  `CVE-2026-9742` · CVE record: MongoDB MongoDB Server · CVSS 8.2 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1287
- [Client side encryption fails to encrypt values in a $vectorSearch](https://agentprime.io/advisories/CVE-2026-9741.md)
  `CVE-2026-9741` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Weak cryptography or TLS
- [Flaw in the updateUser Command May Allow Unauthorized Configuration Change](https://agentprime.io/advisories/CVE-2026-6915.md)
  `CVE-2026-6915` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-1284
- [MD5 checksum creation may cause availability loss](https://agentprime.io/advisories/CVE-2026-6914.md)
  `CVE-2026-6914` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 29 Apr 2026 · Tags: Memory corruption
- [Users could trigger a crash of mongod primaries during promotion to sharded](https://agentprime.io/advisories/CVE-2026-5170.md)
  `CVE-2026-5170` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/technology/mongodb-server.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mongodb-server&cursor=WyIyMDI2LTA3LTIyVDE5OjIwOjQwLjUyOTAwMFoiLCJDVkUtMjAyNi05NzM3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mongodb-server/?cursor=WyIyMDI2LTA3LTIyVDE5OjIwOjQwLjUyOTAwMFoiLCJDVkUtMjAyNi05NzM3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.