MongoDB Inc Mongoid

• CVE-2026-93759 High 8.6 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist 0.4%
• CVE-2026-93760 High 8.2 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard 0.5%
• CVE-2026-93761 High 7.5 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher 0.5%
• CVE-2026-93762 Critical 9.8 Data deletion and attribute disclosure via field-name method injection in in-memory queries 0.6%
• CVE-2026-93763 Medium 6.5 Silent plaintext persistence via unresolved callable database name in encryption schema map 0.2%
• CVE-2026-93764 Medium 6.5 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation 0.1%
• CVE-2026-93765 Critical 9.1 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation 0.5%
• CVE-2026-93758 High 8.1 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes 0.4%