VendorsMongoDBmongoidall versions
Vulnerabilities

MongoDB Mongoid

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

8CVEs
CVE-2026-93762
Data deletion and attribute disclosure via field-name method injection in in-memory queries
Published 2026-09-18 · Analyzed
9.8EPSS 0.006
CVE-2026-93765
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
Published 2026-09-18 · Analyzed
9.1EPSS 0.005
CVE-2026-93759
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
Published 2026-09-18 · Analyzed
8.8EPSS 0.004
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
Published 2026-09-18 · Analyzed
8.7EPSS 0.005
CVE-2026-93758
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
Published 2026-09-18 · Analyzed
8.6EPSS 0.004
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Published 2026-09-18 · Analyzed
8.3EPSS 0.005
CVE-2026-93763
Silent plaintext persistence via unresolved callable database name in encryption schema map
Published 2026-09-18 · Analyzed
7.1EPSS 0.002
CVE-2026-93764
Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
Published 2026-09-18 · Analyzed
7.1EPSS 0.002