Brand
MongoDB: actively exploited vulnerabilities
2 vulnerabilities in MongoDB products (mongo-express, MongoDB Server) are in CISA’s catalog of exploited vulnerabilities. Last added: December 29, 2025.
-
1 vulnerability added in the last 12 months
-
2 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one MongoDB category to your radar, or open its page.
- ERP, business applications and databases 2 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
Follow a single MongoDB product (mongo-express, MongoDB Server…) rather than the whole brand.
- mongo-express1 vulnerability, Business apps and data
- MongoDB Server1 vulnerability, Business apps and data
Name used by CISA: MongoDB. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this MongoDB list.
- Rank 1
MongoDB ServerCVE-2025-14847
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
CVSS severity 7.5high
Added Dec 29, 2025
- Rank 2
MongoDB mongo-expressCVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
CVE from 2019, added in 2021
CVSS severity 9.9critical
Added Dec 10, 2021
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.