MongoDB (Vendor): news timeline & CVEs

MongoDB Security Advisory (AV26-945)

Canada's Cyber Centre warns that multiple Mongoid and MongoDB C Driver versions have vulnerabilities.

The Canadian Centre for Cyber Security issued advisory AV26-945 on September 21, 2026. As of September 17, 2026, multiple versions of Mongoid and the MongoDB C Driver are affected by vulnerabilities. The centre tells users and administrators to review MongoDB's linked advisory and apply necessary updates. The alert does not name specific CVEs or report exploitation.

Canadian Centre for Cyber SecuritySep 21, 17:21 UTC · 5d agoAdvisory

MongoDB security advisory (AV26-911)

Canada's Cyber Centre warns MongoDB Java Driver and Laravel MongoDB (PHP) have vulnerabilities fixed in versions 5.11.1 and 5.11.0.

The Canadian Centre for Cyber Security (AV26-911) reports MongoDB vulnerabilities affecting the Java Driver prior to 5.11.1 and Laravel MongoDB (PHP) prior to 5.11.0. Fixed issues include a native heap use-after-free during cancellation racing a KMS credential fetch in reactive encryption (JAVA-6276) and a query builder fix forcing literal equality when 3-arg where clauses use '=' with array values (PHPLARA-260). Administrators are urged to review the advisories and apply the updates.

Canadian Centre for Cyber SecuritySep 11, 13:38 UTC · 15d agoAdvisory2

MongoDB

Timeline2 articles

Appears with

MongoDB Security Advisory (AV26-945)

MongoDB security advisory (AV26-911)