MongoDB Mongoid
8 CVEs affecting MongoDB Mongoid. Latest disclosed: 2026-09-18. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93762 | Critical | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to c… |
CVE-2026-93765 | Critical | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from… |
CVE-2026-93759 | High | 8.6 | 2026-09-18 | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript exp… |
CVE-2026-93760 | High | 8.2 | 2026-09-18 | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In… |
CVE-2026-93758 | High | 8.1 | 2026-09-18 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges… |
CVE-2026-93761 | High | 7.5 | 2026-09-18 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cau… |
CVE-2026-93764 | Medium | 6.5 | 2026-09-18 | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enabl… |
CVE-2026-93763 | Medium | 6.5 | 2026-09-18 | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-sid… |