en
MongoDB, Inc. is a software company that develops and provides commercial support for the MongoDB document database and related tools. It focuses on a global, multi-product offering that enables developers and organizations to build, deploy, and scale modern applications.
As of 11/14/2026, MongoDB Inc. recorded 18 security vulnerabilities in the last 90 days across 7 products, including 12 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Mongoid had the most security vulnerabilities in the MongoDB Inc. ecosystem, with 8 vulnerabilities—approximately 44.44% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2021-20329Specific cstrings input may not be properly validated in the Go DriverCVE-2021-20331MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an applicationCVE-2021-20326Specially crafted query may result in a denial of service of mongodCVE-2020-7924Specific command line parameter might result in accepting invalid certificateCVE-2021-20334Local privilege escalation in MongoDB Compass for Windows| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2021-20329Specific cstrings input may not be properly validated in the Go Driver | Exploitation statusNot confirmed | FixYes |
| Published06/10/2021 |
| SeverityMedium |
CVE-2021-20331MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application | Exploitation statusNot exploited | FixYes | Affected productMongoDB C# Driver | Published05/13/2021 | SeverityMedium |
|---|
CVE-2021-20326Specially crafted query may result in a denial of service of mongod | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published04/30/2021 | SeverityMedium |
|---|
CVE-2020-7924Specific command line parameter might result in accepting invalid certificate | Exploitation statusNot exploited | FixYes | Affected productMongoDB Database Tools | Published04/12/2021 | SeverityMedium |
|---|
CVE-2021-20334Local privilege escalation in MongoDB Compass for Windows | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Compass | Published04/06/2021 | SeverityMedium |
|---|
CVE-2020-7929Specially crafted regex query can cause DoS | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published03/01/2021 | SeverityMedium |
|---|
CVE-2018-25004Invariant failure when explaining a find with a UUID | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published03/01/2021 | SeverityMedium |
|---|
CVE-2021-20328MongoDB Java driver client-side field level encryption not verifying KMS host name | Exploitation statusNot exploited | FixYes | Affected productmongo-java-driver | Published02/25/2021 | SeverityMedium |
|---|
CVE-2021-20327MongoDB Node.js client side field level encryption library may not be validating KMS certificate | Exploitation statusNot confirmed | FixNo | Affected productMongoDB Node.js Driver mongodb-client-encryption module | Published02/25/2021 | SeverityMedium |
|---|
CVE-2021-20335SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Ops Manager | Published02/11/2021 | SeverityMedium |
|---|
CVE-2019-20925Denial of service via malformed network packet | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/24/2020 | SeverityHigh |
|---|
CVE-2020-7928Improper neutralization of null byte leads to read overrun | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7927Potential privilege escalation in Ops Manager API | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Ops Manager | Published11/23/2020 | SeverityHigh |
|---|
CVE-2020-7926Specific query can cause a DoS against MongoDB Server | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7925Denial of Service when processing malformed Role names | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityHigh |
|---|
CVE-2019-2393Crash while joining collections with $lookup | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-2392$mod can result in undefined behavior | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-20924Invariant in IndexBoundsBuilder | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-20923Crash while handling internal Javascript exception types | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20805Invariant with $elemMatch | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20804Invariant failure in applyOps | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20803Infinite loop in aggregation expression | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20802Post-auth queries on compound index may crash mongod | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7923Specific GeoQuery can cause DoS against MongoDB Server | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published08/21/2020 | SeverityMedium |
|---|
CVE-2019-2388Potential exposure of log information in Ops Manager | Exploitation statusNot confirmed | FixNo | Affected productMongoDB Ops Manager | Published05/13/2020 | SeverityMedium |
|---|
CVE-2020-7921Administrative action may disable enforcement of per-user IP whitelisting | Exploitation statusNot exploited | FixYes | Affected productMongoDB Server | Published05/06/2020 | SeverityMedium |
|---|
CVE-2020-7922Improper X.509 certificate validation in MongoDB Inc. MongoDB Enterprise Kubernetes Operator can grant unauthorized MongoDB access | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Enterprise Kubernetes Operator | Published04/09/2020 | SeverityMedium |
|---|
CVE-2019-2391JS-bson may incorrectly serialise some requests | Exploitation statusNot confirmed | FixYes | Affected productjs-bson | Published03/31/2020 | SeverityMedium |
|---|
CVE-2019-2390Code execution on Windows via OpenSSL engine injection | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published08/30/2019 | SeverityHigh |
|---|
CVE-2019-2389Process termination via PID file manipulation | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published08/30/2019 | SeverityMedium |
|---|
CVE-2019-2386Authorization session conflation | Exploitation statusNot confirmed | FixYes | Affected productMongoDB Server | Published08/06/2019 | SeverityHigh |
|---|
81 Results | Page 2 of 2