Advisories · Technology
MongoDB Inc. Mongoid.
Every CVE that names MongoDB Inc. Mongoid among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
- MongoDB Inc. Mongoid
- Code injection
- CVSS 8.3 High
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
- MongoDB Inc. Mongoid
- Other injection
- CVSS 8.7 High
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
- MongoDB Inc. Mongoid
- Denial of service
- CVSS 9.2 CriticalCritical · CVSS 9+
Data deletion and attribute disclosure via field-name method injection in in-memory queries
- MongoDB Inc. Mongoid
- Code injection
- CVSS 7.1 High
Silent plaintext persistence via unresolved callable database name in encryption schema map
- MongoDB Inc. Mongoid
- Information disclosure
- CVSS 7.1 High
Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
- MongoDB Inc. Mongoid
- Information disclosure
- CVSS 8.3 High
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
- MongoDB Inc. Mongoid
- Code injection
- CVSS 8.6 High
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
- MongoDB Inc. Mongoid
- Broken access control