Vulnerabilidades em MongoDB Inc.

53 resultados
Análise Vexday

Com 53 CVEs catalogadas, o perfil de vulnerabilidades do MongoDB Inc. não apresenta falhas de severidade crítica, mas chama atenção pela taxa de exploração ativa: 1,89% das CVEs constam no catálogo CISA KEV, proporção 4,2 vezes acima da média geral do catálogo. A CVE-2025-14847 concentra o maior risco imediato, com EPSS de 0,83 — indicando alta probabilidade de exploração — e é a única entrada atualmente confirmada como explorada ativamente. O tipo de falha mais recorrente, CWE-20 (validação inadequada de entrada), sugere uma superfície de ataque que tende a ser amplamente explorada quando exposta. A chegada de 4 novas CVEs nos últimos 90 dias e a existência de prova de conceito pública para uma delas reforçam a necessidade de ciclos de remediação ágeis em ambientes que utilizam produtos dessa linha.

CVE-2021-32036MEDIUMDenial of Service and Data Integrity vulnerability in features commandEPSS 1.0%CVE-2020-7927HIGHPotential privilege escalation in Ops Manager APIEPSS 1.0%CVE-2019-2390HIGHCode execution on Windows via OpenSSL engine injectionEPSS 1.0%CVE-2018-25004MEDIUMInvariant failure when explaining a find with a UUIDEPSS 1.0%CVE-2019-2388MEDIUMPotential exposure of log information in Ops ManagerEPSS 1.0%CVE-2021-20329MEDIUMSpecific cstrings input may not be properly validated in the Go DriverEPSS 1.0%CVE-2021-20326MEDIUMSpecially crafted query may result in a denial of service of mongodEPSS 0.9%CVE-2019-2391MEDIUMJS-bson may incorrectly serialise some requestsEPSS 0.9%CVE-2023-0342LOWMongoDB Ops Manager may disclose sensitive information in Diagnostic ArchiveEPSS 0.9%CVE-2022-24272MEDIUMMongoDB Server (mongod) may crash in response to unexpected requestsEPSS 0.9%CVE-2020-7924MEDIUMSpecific command line parameter might result in accepting invalid certificateEPSS 0.7%CVE-2020-7922MEDIUMKubernetes Operator generates potentially insecure certificatesEPSS 0.7%CVE-2020-7921MEDIUMAdministrative action may disable enforcement of per-user IP whitelistingEPSS 0.7%CVE-2021-20331MEDIUMMongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an applicationEPSS 0.6%CVE-2023-4009HIGHPrivilege Escalation for Project Owner and Project User Admin Roles in Ops ManagerEPSS 0.6%CVE-2021-20328MEDIUMMongoDB Java driver client-side field level encryption not verifying KMS host nameEPSS 0.4%CVE-2025-12657MEDIUMMalformed KMIP response may result in access violationEPSS 0.4%CVE-2026-6811MEDIUMPHP Stack ExhaustionEPSS 0.3%CVE-2021-20332MEDIUMMongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an applicationEPSS 0.3%CVE-2019-2389MEDIUMProcess termination via PID file manipulationEPSS 0.3%