Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-81522

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C\# Driver C\+\+ Driver
CVE-2026-84966

BSON element injection via NUL-embedded document keys in builder append

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C++ Driver C\+\+ Driver
CVE-2026-88034

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C++ Driver C\+\+ Driver
CVE-2026-84970

Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C\# Driver C\+\+ Driver