CVE-2026-13072

HighCVSS 8.1/10Last modified Oct 24, 2026

Description

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-130734.3An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation commanCVE-2026-130745.3An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to CVE-2026-130756.5An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $sCVE-2026-130766.5An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specificCVE-2026-130777.1A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggreCVE-2026-130787.7A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hoCVE-2026-130797.8A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate theiCVE-2026-130806.6The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion iCVE-2026-130825.3GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CACVE-2026-130836.9A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitizatiCVE-2026-130847.5A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-serviceCVE-2026-130869.3A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard