Skip to content
OpenAdvisories

Product · MongoDB

MongoDB Server

203 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-13078 Public exploit

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.5
    CVE-2025-14847 Exploited Public exploit EPSS 83%

    Zlib compressed protocol header length confusion may allow memory read

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB…

    MongoDB MongoDB Server mongodb Ubuntu
    KEV Dec 29, 2025
  • High 7.7
    CVE-2025-6713 Public exploit

    MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

    An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This i…

    MongoDB MongoDB Server mongodb Ubuntu