Automattic mongoose

• CVE-2026-73562 Medium 6.5 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) 0.5%
• CVE-2026-42334 High 7.5 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection 0.3%