Vérifiez votre version
mongod --versionBranches de versions concernées
- 9.1 26 CVE
- 9.0 30 CVE
- 8.3 96 CVE
- 8.2 85 CVE KEV 1 Fin de vie
- 8.1 4 CVE Fin de vie
- 8.0 116 CVE KEV 1
- 7.3 4 CVE Fin de vie
- 7.0 113 CVE KEV 1
- 6.3 3 CVE Fin de vie
- 6.1 3 CVE Fin de vie
- 6.0 31 CVE KEV 1 Fin de vie
- 5.0 22 CVE KEV 1 Fin de vie
- 4.5 2 CVE
- 4.4 14 CVE KEV 1 Fin de vie
- 4.3 4 CVE KEV 1
- 4.2 14 CVE KEV 1 Fin de vie
- 4.0 21 CVE KEV 1 Fin de vie
- 3.6 18 CVE KEV 1 Fin de vie
- 3.4 8 CVE Fin de vie
- 3.3 3 CVE
- 3.2 3 CVE Fin de vie
- 3.0 4 CVE Fin de vie
- 2.6 6 CVE Fin de vie
- 2.5 5 CVE
- 2.4 8 CVE Fin de vie
- 2.3 6 CVE
- 2.2 7 CVE Fin de vie
- 2.0 7 CVE Fin de vie
- 1.17 7 CVE
- 1.13 7 CVE
- 1.8 6 CVE Fin de vie
- 1.7 7 CVE
- 1.6 6 CVE Fin de vie
- 1.4 6 CVE Fin de vie
- 1.2 6 CVE Fin de vie
- 0.7 7 CVE
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read | ≥ 3.6.0 < 4.4.30 ≥ 5.0.0 < 5.0.32 ≥ 6.0.0 < 6.0.27 | 8.7 | KEV | 83.2% | 2025-12-19 |
| CVE-2026-118383 | Pre-authentication use-after-free in MongoDB Server replica set primary catch-up | ≥ 4.4.0 < 4.4.32 ≥ 5.0.0 < 5.0.35 ≥ 6.0.0 < 6.0.30 | 9.5 | 0.7% | 2026-11-11 | |
| CVE-2026-89099 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption | ≥ 7.0.0 < 7.0.43 ≥ 8.0.0 < 8.0.32 ≥ 8.3.0 < 8.3.11 | 7.7 | — | 2026-09-12 | |
| CVE-2026-82076 | Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 < 8.2.13 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82075 | Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 8.7 | — | 2026-09-09 | |
| CVE-2026-82074 | Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82073 | Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Colle... | ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82071 | Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write | ≥ 8.3.0 < 8.3.9 | 7.2 | — | 2026-09-09 | |
| CVE-2026-82069 | Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Route... | ≥ 8.3.0 < 8.3.9 | 5.1 | — | 2026-09-09 | |
| CVE-2026-82070 | Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82068 | Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Ser... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82066 | Heap Out-of-Bounds Read in MongoDB Server Query Planning Component | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 5.3 | — | 2026-09-09 | |
| CVE-2026-82067 | Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remai... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 9.2 | — | 2026-09-09 | |
| CVE-2026-82065 | Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Servi... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82064 | Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replic... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 8.7 | — | 2026-09-09 | |
| CVE-2026-82062 | Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables v... | ≥ 8.3.0 < 8.3.9 | 7.0 | — | 2026-09-09 | |
| CVE-2026-82063 | Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 6.0 | — | 2026-09-09 | |
| CVE-2026-82061 | Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service | ≥ 8.3.0 < 8.3.9 | 7.2 | — | 2026-09-09 | |
| CVE-2026-82060 | Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stre... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 2.3 | — | 2026-09-09 | |
| CVE-2026-82059 | Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure an... | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 6.0 | — | 2026-09-09 | |
| CVE-2026-82057 | Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persis... | ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82058 | Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82056 | Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 6.0 | — | 2026-09-09 | |
| CVE-2026-82054 | Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82055 | Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service | ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-82053 | Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 ≤ 8.2.12 | 7.6 | — | 2026-09-09 | |
| CVE-2026-82052 | $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars | ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 | 7.1 | — | 2026-09-09 | |
| CVE-2026-84967 | Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal | ≥ 1.13.0 < 1.17.1 | 5.1 | — | 2026-09-04 | |
| CVE-2026-18712 | Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.2 | — | 2026-08-12 | |
| CVE-2026-18711 | Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure | ≥ 7.0.0 ≤ 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18709 | Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsist... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 5.9 | — | 2026-08-12 | |
| CVE-2026-18698 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Co... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 5.3 | — | 2026-08-12 | |
| CVE-2026-18690 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.2 | — | 2026-08-12 | |
| CVE-2026-18699 | Improper Input Validation in MongoDB Query Planner Leads to Denial of Service | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 6.0 | — | 2026-08-12 | |
| CVE-2026-18691 | Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 9.0 | — | 2026-08-12 | |
| CVE-2026-18702 | Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic S... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 5.3 | — | 2026-08-12 | |
| CVE-2026-18694 | Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disc... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18708 | Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Ex... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 5.3 | — | 2026-08-12 | |
| CVE-2026-18696 | Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.0 | — | 2026-08-12 | |
| CVE-2026-18700 | Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 6.0 | — | 2026-08-12 | |
| CVE-2026-18701 | Type Confusion in MongoDB Query Subsystem Leads to Denial of Service | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18697 | Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 8.7 | — | 2026-08-12 | |
| CVE-2026-18693 | Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory... | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.2 | — | 2026-08-12 | |
| CVE-2026-18705 | Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18704 | Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Op... | ≥ 8.3.0 < 8.3.8 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18692 | Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Exec... | ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 | 7.7 | — | 2026-08-12 | |
| CVE-2026-18688 | Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18695 | Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18687 | Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index... | ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 | 7.1 | — | 2026-08-12 | |
| CVE-2026-18706 | Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code... | ≥ 8.3.0 < 8.3.8 = 9.0.0 | 7.5 | — | 2026-08-12 | |
| CVE-2026-18707 | Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service | ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 | 5.3 | — | 2026-08-12 | |
| CVE-2026-18703 | Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authent... | ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 = 9.0.0 | 2.3 | — | 2026-08-12 | |
| CVE-2026-13055 | Server crash via aggregation pipeline expression with compound wildcard index specification | ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 | 7.1 | — | 2026-07-23 | |
| CVE-2026-13056 | A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of... | ≥ 8.0.0 < 8.0.28 ≥ 8.3.0 < 8.3.7 | 7.1 | — | 2026-07-23 | |
| CVE-2026-13057 | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$... | ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 ≥ 8.3.0 < 8.3.7 | 6.0 | — | 2026-07-23 | |
| CVE-2026-13058 | Transaction Command Insufficient Input Validation Leading to Process Termination | ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 ≥ 8.3.0 < 8.3.7 | 7.1 | — | 2026-07-23 | |
| CVE-2026-13059 | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 | 8.6 | — | 2026-07-23 | |
| CVE-2026-9737 | Find command with $meta sort can lead to crash | ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 ≤ 8.2.12 | 7.1 | — | 2026-07-23 | |
| CVE-2026-13060 | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access | ≥ 7.0.0 < 7.0.39 | 7.1 | — | 2026-07-23 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).