InfraGuard
ログイン 今すぐ試す 今すぐ購入

MongoDB の脆弱性（CVE一覧）

189 CVE1 KEV9.5 最大CVSS
バージョンを確認するmongod --version

影響を受けるバージョン系列

既知の脆弱性

CVE タイトル 影響を受けるバージョン CVSS 悪用 EPSS 公開日
CVE-2025-14847 Zlib compressed protocol header length confusion may allow memory read ≥ 3.6.0 < 4.4.30 ≥ 5.0.0 < 5.0.32 ≥ 6.0.0 < 6.0.27 8.7 KEV 83.2% 2025-12-19
CVE-2026-118383 Pre-authentication use-after-free in MongoDB Server replica set primary catch-up ≥ 4.4.0 < 4.4.32 ≥ 5.0.0 < 5.0.35 ≥ 6.0.0 < 6.0.30 9.5 0.7% 2026-11-11
CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption ≥ 7.0.0 < 7.0.43 ≥ 8.0.0 < 8.0.32 ≥ 8.3.0 < 8.3.11 7.7 — 2026-09-12
CVE-2026-82076 Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 < 8.2.13 7.1 — 2026-09-09
CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 8.7 — 2026-09-09
CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 7.1 — 2026-09-09
CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Colle... ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write ≥ 8.3.0 < 8.3.9 7.2 — 2026-09-09
CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Route... ≥ 8.3.0 < 8.3.9 5.1 — 2026-09-09
CVE-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-09-09
CVE-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Ser... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 5.3 — 2026-09-09
CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remai... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 9.2 — 2026-09-09
CVE-2026-82065 Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Servi... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82064 Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replic... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 8.7 — 2026-09-09
CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables v... ≥ 8.3.0 < 8.3.9 7.0 — 2026-09-09
CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 6.0 — 2026-09-09
CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service ≥ 8.3.0 < 8.3.9 7.2 — 2026-09-09
CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stre... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 2.3 — 2026-09-09
CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure an... ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 6.0 — 2026-09-09
CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persis... ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 6.0 — 2026-09-09
CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-09-09
CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.2.0 ≤ 8.2.12 7.6 — 2026-09-09
CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars ≥ 7.0.0 < 7.0.41 ≥ 8.0.0 < 8.0.30 ≥ 8.3.0 < 8.3.9 7.1 — 2026-09-09
CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal ≥ 1.13.0 < 1.17.1 5.1 — 2026-09-04
CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.2 — 2026-08-12
CVE-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure ≥ 7.0.0 ≤ 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsist... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 5.9 — 2026-08-12
CVE-2026-18698 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Co... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 5.3 — 2026-08-12
CVE-2026-18690 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.2 — 2026-08-12
CVE-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 6.0 — 2026-08-12
CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 9.0 — 2026-08-12
CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic S... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 5.3 — 2026-08-12
CVE-2026-18694 Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disc... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18708 Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Ex... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 5.3 — 2026-08-12
CVE-2026-18696 Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.0 — 2026-08-12
CVE-2026-18700 Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 6.0 — 2026-08-12
CVE-2026-18701 Type Confusion in MongoDB Query Subsystem Leads to Denial of Service ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18697 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 8.7 — 2026-08-12
CVE-2026-18693 Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory... ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.2 — 2026-08-12
CVE-2026-18705 Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Op... ≥ 8.3.0 < 8.3.8 7.1 — 2026-08-12
CVE-2026-18692 Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Exec... ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 7.7 — 2026-08-12
CVE-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-08-12
CVE-2026-18687 Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index... ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 7.1 — 2026-08-12
CVE-2026-18706 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code... ≥ 8.3.0 < 8.3.8 = 9.0.0 7.5 — 2026-08-12
CVE-2026-18707 Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service ≥ 7.0.0 < 7.0.40 ≥ 8.0.0 < 8.0.29 ≥ 8.2.0 ≤ 8.2.12 5.3 — 2026-08-12
CVE-2026-18703 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authent... ≥ 8.2.0 ≤ 8.2.12 ≥ 8.3.0 < 8.3.8 = 9.0.0 2.3 — 2026-08-12
CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 7.1 — 2026-07-23
CVE-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of... ≥ 8.0.0 < 8.0.28 ≥ 8.3.0 < 8.3.7 7.1 — 2026-07-23
CVE-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$... ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 ≥ 8.3.0 < 8.3.7 6.0 — 2026-07-23
CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 ≥ 8.3.0 < 8.3.7 7.1 — 2026-07-23
CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 < 8.2.12 8.6 — 2026-07-23
CVE-2026-9737 Find command with $meta sort can lead to crash ≥ 7.0.0 < 7.0.39 ≥ 8.0.0 < 8.0.28 ≥ 8.2.0 ≤ 8.2.12 7.1 — 2026-07-23
CVE-2026-13060 $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access ≥ 7.0.0 < 7.0.39 7.1 — 2026-07-23

自社サーバーでこれらのバージョンを追跡

InfraGuard はすべてのサーバーからインストール済みソフトウェアのバージョンを収集し、既知の脆弱性があるものを通知します。セルフホスト型なので、データがネットワーク外に出ることはありません。

ライブデモを試す 今すぐ購入

悪用された脆弱性の週刊ダイジェスト

セルフホスト型サーバーに関係する KEV の追加情報を週1回お届けします。それ以外のメールは送りません。

データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。