https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-7610.htmlhttps://patchthecve.com/cve/CVE-2020-7610.htmlWed, 17 Jun 2026 03:25:07 +0000CRITICAL 9.8: All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.https://patchthecve.com/cve/CVE-2015-4411.htmlhttps://patchthecve.com/cve/CVE-2015-4411.htmlWed, 17 Jun 2026 00:27:14 +0000HIGH 7.5: The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.https://patchthecve.com/cve/CVE-2015-4412.htmlhttps://patchthecve.com/cve/CVE-2015-4412.htmlWed, 17 Jun 2026 00:27:14 +0000CRITICAL 9.8: BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.