UpHeron
All vulnerabilities

Servers and applications

CVE-2026-18708

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their…

Severity
Medium 5.3
Published
11 Aug 2026
Last changed
16 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.40, 8.0.29, 8.3.8
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • Version 9.1.0-alpha0
  • Version 9.0.0-alpha1
  • Version 9.0.0-alpha0
  • From 8.3.0 before 8.3.8
All 7 release lines
  • From 7.0.0 before 7.0.40
  • From 8.0.0 before 8.0.29
  • From 8.2.0 up to 8.2.12
  • From 8.3.0 before 8.3.8
  • Version 9.0.0-alpha0
  • Version 9.0.0-alpha1
  • Version 9.1.0-alpha0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-18708
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-18708