CVE-2026-73562

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-73562: Improperly Controlled Modification of Object Prototype Attributes

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-15698

CVE-2026-15698 affects kofrasa mingo up to 7.2.1. The vulnerability lies in the Update API’s functions update/updateOne/updateMany, where manipulating the Set argument can lead to prototype pollution of object attributes. The issue is exploitable remotely, and a fix is available in version 7.2.2 ...

PT-2026-58064

Name of the Vulnerable Software and Affected Versions kofrasa mingo versions prior to 7.2.2 Description An issue exists in the Update API component where manipulating the Set argument within the update, updateOne, and updateMany functions can lead to improperly controlled modification of object...

CVE-2026-15698: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched...