MongoDB released 8.0.34 on Oct 13 with fixes for CVE-2026-96297, CVE-2026-103965, and CVE-2026-104004 (related JIRAs include SERVER-132946 heap-use-after-free in $_internalApplyOplogUpdate, SERVER-134618 $bucket serialization, SERVER-131412 validation). CERT-FR advisory CERTFR-2026-AVI-1304 (Oct 14) also lists CVE-2026-104005 and CVE-2026-96299 and says the flaws can enable remote code execution and/or remote denial of service. Affected trains per CERT-FR: 7.x before 7.0.45, 8.0.x before 8.0.34, 8.3.x before 8.3.13, plus 9.0/9.1 release candidates below the named RCs. Upgrade to the fixed patch lines from MongoDB; Atlas customers should confirm auto-upgrade settings. Not on CISA KEV as of catalogVersion 2026.10.14.