What’s Vulnerable › Products

MongoDB Inc. Mongoid vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your MongoDB Inc. Mongoid version is affected

Latest MongoDB Inc. Mongoid vulnerabilities

• CVE-2026-93764 — Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (CVSS 6.5)
• CVE-2026-93763 — Silent plaintext persistence via unresolved callable database name in encryption schema map (CVSS 6.5)
• CVE-2026-93762 — Data deletion and attribute disclosure via field-name method injection in in-memory queries (CVSS 9.8)
• CVE-2026-93761 — Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (CVSS 7.5)
• CVE-2026-93760 — NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (CVSS 8.2)
• CVE-2026-93759 — Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (CVSS 8.6)
• CVE-2026-93765 — Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (CVSS 9.1)
• CVE-2026-93758 — Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (CVSS 8.1)