CVE-2026-93762

Mongoid (MongoDB's Ruby ODM) has an unsafe reflection weakness in the in-memory query path used for embedded documents . When an application passes an externally supplied field name to certain query methods, an unauthenticated attacker can achieve attribute disclosure of stored document data and ...

CVE-2026-93760

Mongoid , the Ruby ODM for MongoDB, allows caller-supplied filter data to carry unrestricted query operators when an application forwards externally supplied parameters to its query-building methods. Because the operator guard is unsafe by default , an unauthenticated party can influence how the ...

CVE-2026-93758

Mongoid , MongoDB's object-document mapper for Ruby, is affected by an insecure direct object reference in its nested attributes handling. A user with basic application privileges can supply a record identifier belonging to another user; the target record is then looked up without the usual owner...

CVE-2026-93765

Mongoid (Ruby ODM for MongoDB) has an unsafe reflection weakness in the document persistence layer. Unvalidated method-name dispatch in the atomic pop operation allows an unauthenticated party—via keys passed through an embedding application—to trigger unintended internal method invocations inste...

CVE-2026-93759

Mongoid , the Ruby ODM for MongoDB, is vulnerable to server-side JavaScript injection via its query builder. A string-typed query criterion is not neutralized before being passed to the database as a server-side JavaScript expression. An unauthenticated attacker who can influence a query argument...

CVE-2026-93761

CVE-2026-93761 affects the Mongoid library (MongoDB's Ruby ODM). The vulnerability resides in the in-memory query evaluation component , where an inefficient regular expression complexity issue (ReDoS) can be triggered when user-supplied text is placed into a pattern-matching query condition on a...

CVE-2026-93764

Mongoid , MongoDB's Ruby ODM, may omit encryption rules for fields declared on embedded models when generating its client-side field-level encryption schema. Applications that enable this feature can silently store values intended to be encrypted in plaintext , with no error or warning. A party w...

CVE-2026-93763

This vulnerability affects Mongoid , a Ruby object-document mapper for MongoDB. A protection mechanism failure in the encryption configuration generation — specifically an unresolved callable database name in the encryption schema map — causes fields declared for client-side field-level encryptio...