4155 matches found
EUVD-2026-56906
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
EUVD-2026-56905
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...
CVE-2026-18692
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...
CVE-2026-18692
Summary: CVE-2026-18692 affects MongoDB Server, specifically its timeseries bucket lifecycle handling. An authenticated user with write privileges can trigger a use-after-free condition in internal memory after a reference is freed, which could cause a server crash or, potentially, execution of u...
CVE-2026-18692 Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...
Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...
CVE-2026-18688
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...
CVE-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...
Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...
EUVD-2026-56904
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...
CVE-2026-18688
The CVE-2026-18688 entry describes an issue in MongoDB Server's aggregation framework that allows an authenticated user to trigger an out-of-bounds memory read by supplying a specially formed numeric parameter in a specific aggregation pipeline stage. This could cause a server crash (denial of se...
CVE-2026-18695
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...
CVE-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...
EUVD-2026-56865
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...
CVE-2026-18695
CVE-2026-18695 affects MongoDB Server, specifically time-series collections that use a metaField. The issue occurs in how certain query predicates are processed, and an authenticated user with write access can cause the server process to terminate unexpectedly, resulting in a denial of service. T...
Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...
CVE-2026-18687 Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a...
CVE-2026-18687
Summary: CVE-2026-18687 affects MongoDB Server’s Queryable Encryption maintenance operation. The issue arises because request parameters are not properly validated against the collection’s encrypted field configuration before use. What’s affected: MongoDB Server handling of Queryable Encryption m...