MongoDB C++ Driver vulnerabilities

5 CVEs affecting MongoDB C++ Driver, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106430, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-81522, published 2026-08-27. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier…
CVE-2026-88034, published 2026-09-10. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query…
CVE-2026-106430, published 2026-10-08. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to…
CVE-2026-84966, published 2026-09-03. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an…
CVE-2026-84970, published 2026-09-03. Medium severity, CVSS 5.8. EPSS: 0.1% chance of exploitation in the next 30 days. A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public…