MongoDB Inc. Mongoid
6 CVEs affecting MongoDB Inc. Mongoid. Latest disclosed: 2026-09-18. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93762 | Critical | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to c… |
CVE-2026-93765 | Critical | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from… |
CVE-2026-93759 | High | 8.6 | 2026-09-18 | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript exp… |
CVE-2026-93758 | High | 8.1 | 2026-09-18 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges… |
CVE-2026-93764 | Medium | 6.5 | 2026-09-18 | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enabl… |
CVE-2026-93763 | Medium | 6.5 | 2026-09-18 | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-sid… |