CVE-2026-88023

CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

PT-2026-89515

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

PT-2026-89541

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the embedded-document relation handling allows an authenticated user to manipulate an embedded...

PT-2026-89548

Name of the Vulnerable Software and Affected Versions MongoDB C++ Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a quer...

PT-2026-89514

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

PT-2026-89542

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the polymorphic relation handling allows a caller-supplied relation identifier to be interpreted...

PT-2026-89550

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

PT-2026-89543

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver versions prior to 4.18.1 Description Improper neutralization of special elements in the data query logic of the GridFS component allows a caller-supplied structured file identifier to be interpreted as a query condition...

PT-2026-89544

Name of the Vulnerable Software and Affected Versions MongoDB Ruby Driver affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

PT-2026-89545

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifie...

PT-2026-89547

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a que...

PT-2026-89513

Name of the Vulnerable Software and Affected Versions MongoDB PHP Library affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

MongoDB Ruby Driver - Improper neutralization of special elements in data query logic in the GridFS component

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-70791

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

CVE-2026-62906

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

GHSA-3F6P-5WW8-9RCR vulnerabilities

Vulnerabilities for packages: sqlpad...

EUVD-2026-52277

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...

CVE-2026-85167

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...