Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

MongoDB: actively exploited vulnerabilities

2 vulnerabilities in MongoDB products (mongo-express, MongoDB Server) are in CISA’s catalog of exploited vulnerabilities. Last added: December 29, 2025.

By category

Add just one MongoDB category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • mongo-express 1 vulnerability · Business apps and data
  • MongoDB Server 1 vulnerability · Business apps and data

Name used by CISA: MongoDB. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this MongoDB list.

  1. Rank 1MongoDB Server

    CVE-2025-14847

    MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Dec 29, 2025
    CISA deadline
    21 days
    CVSS severity
    7.5 (high)

  2. Rank 2MongoDB mongo-express

    CVE-2019-10758

    CVE from 2019, added in 2021

    MongoDB mongo-express Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Dec 10, 2021
    CISA deadline
    182 days
    CVSS severity
    9.9 (critical)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.