CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,468
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product mongodb:c_driver. Show all products

26 CVEs, showing 1 to 26
CVESeverityTitlePublished
CVE-2026-106438Medium 4.0Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
Assigned by mongodb
Oct 8, 2026
CVE-2026-106437Medium 6.2Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
Assigned by mongodb
Oct 8, 2026
CVE-2026-106431Medium 5.7One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
Assigned by mongodb
Oct 8, 2026
CVE-2026-106428Low 3.7Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
Assigned by mongodb
Oct 8, 2026
CVE-2026-96746Medium 6.5Heap buffer overflow via mid-scan command list growth in client topology monitoring
Assigned by mongodb
Sep 24, 2026
CVE-2026-93395Medium 5.3Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
Assigned by mongodb
Sep 17, 2026
CVE-2026-93394Low 3.7libmongoc SCRAM client nonce-validation bypass
Assigned by mongodb
Sep 17, 2026
CVE-2026-93393High 8.1Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
Assigned by mongodb
Sep 17, 2026
CVE-2026-88036High 8.3GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
Assigned by mongodb
Sep 10, 2026
CVE-2026-88035Medium 4.7Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
Assigned by mongodb
Sep 10, 2026
CVE-2026-88026Medium 6.5Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
Assigned by mongodb
Sep 10, 2026
CVE-2026-88025High 8.3GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver
Assigned by mongodb
Sep 10, 2026
CVE-2026-84963Medium 5.3Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
Assigned by mongodb
Sep 3, 2026
CVE-2026-84964Medium 5.9Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
Assigned by mongodb
Sep 3, 2026
CVE-2026-84965Medium 5.1Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
Assigned by mongodb
Sep 3, 2026
CVE-2026-84969Low 3.7Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output
Assigned by mongodb
Sep 3, 2026
CVE-2026-81530Medium 5.6KMS master key exposure via unredacted credential serialization in driver settings string
Assigned by mongodb
Aug 27, 2026
CVE-2026-81529High 7.1Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Assigned by mongodb
Aug 27, 2026
CVE-2026-81528Medium 5.4NoSQL injection via array replacement bypassing update shape validation in driver write path
Assigned by mongodb
Aug 27, 2026
CVE-2026-81527Medium 6.5NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
Assigned by mongodb
Aug 27, 2026
CVE-2026-81524Medium 5.4Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
Assigned by mongodb
Aug 27, 2026
CVE-2026-9100High 7.1The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.May 20, 2026
CVE-2026-6691High 7.8The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic.May 6, 2026
CVE-2026-6231High 7.5The bson_validate function may return early on specific inputs and incorrectly report success.Apr 13, 2026
CVE-2026-4359Low 3.7A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.Mar 17, 2026
CVE-2025-12119Low 3.3A mongoc_bulk_operation_t may read invalid memory if large options are passed.Nov 18, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.