CVE-2026-93764

Mongoid , MongoDB's Ruby ODM, may omit encryption rules for fields declared on embedded models when generating its client-side field-level encryption schema. Applications that enable this feature can silently store values intended to be encrypted in plaintext , with no error or warning. A party w...

Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read...

CVE-2026-93763: Cleartext Storage of Sensitive Information

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...

CVE-2026-93764: Cleartext Storage of Sensitive Information

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read...

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

EUVD-2026-82382

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...

Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

BIT-MONGODB-2026-18687 Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a...

mini-diarium v0.7.3

Mini Diarium A local-only journal with serious encryption. Free, open source, and never touches the internet. mini-diarium.com · Download · Documentation · Features · Philosophy · Benchmarks ☕ Support the Project Mini Diarium is free, open source, and will always be. If you find it useful and wan...

CVE-2026-92756: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

CVE-2026-92757: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-86824: Inadequate Encryption Strength

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

CVE-2026-50603: Use of Hard-coded Cryptographic Key

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to...

CVE-2026-76420

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

CVE-2026-77405: Inadequate Encryption Strength

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : SRT vulnerabilities (USN-8764-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8764-1 advisory. It was discovered that SRT did not authenticate certain encryption control messages. A remote attacker could possibly...