products / mongodb
MongoDB
MongoDB is a document database and CNA; NVD entries often include explicit mongodb:mongodb CPE ranges. Use server release versions (6.0.x, 7.0.x) as you would in ops tooling.
api usage
Querying MongoDB
product slug
mongodbversion format
6.0.3, 7.0.2bash
curl "https://api.attestd.io/v1/check?product=mongodb&version=6.0.3" \
-H "Authorization: Bearer $ATTESTD_KEY"Spot-check CVE-2025-14847 (MongoBleed / memory disclosure). Confirm risk_state and fixed_version against live synthesis.
json
{
"product": "mongodb",
"version": "6.0.3",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"active_exploitation",
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": true,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2023-1409",
"CVE-2024-10921",
"CVE-2024-1351",
"CVE-2024-3372",
"CVE-2024-3374",
"CVE-2024-6375",
"CVE-2024-6384",
"CVE-2024-7553",
"CVE-2024-8305",
"CVE-2024-8654",
"CVE-2025-10059",
"CVE-2025-10060",
"CVE-2025-10061",
"CVE-2025-12657",
"CVE-2025-14847",
"CVE-2025-3082",
"CVE-2025-3083",
"CVE-2025-3084",
"CVE-2025-3085",
"CVE-2025-6706",
"CVE-2025-6707",
"CVE-2025-6709",
"CVE-2025-6710",
"CVE-2025-6711",
"CVE-2025-6713",
"CVE-2025-6714",
"CVE-2026-11933",
"CVE-2026-8053",
"CVE-2026-9753"
],
"cves": null,
"max_epss": 0.83007,
"last_updated": "2026-08-16T11:18:08.825063Z",
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null,
"source_published_at": null,
"observed_at": null,
"ingested_at": null,
"first_served_at": null,
"provenance": null
},
"supply_chain_monitored": true,
"typosquat": null
}cleaner line
Newer release
bash
curl "https://api.attestd.io/v1/check?product=mongodb&version=8.0.28" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2025-14847 | Memory disclosure / protocol handling (MongoBleed family). | 6.0.x (see NVD) | 7.5 |
CVE-2021-20328 | Driver / server interaction exposing sensitive data in certain configs. | 4.4, 5.0 | 6.5 |
CVE-2019-2392 | Server component DoS via crafted BSON. | 3.6, 4.0 | 6.5 |
CVE-2020-7928 | Information exposure in MongoDB server. | 4.0, 4.2 | 4.0 |
CVE-2024-6383 | Authorization / privilege boundary issue (verify NVD ranges). | see NVD | 6.0 |
related