https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-88028.htmlhttps://patchthecve.com/cve/CVE-2026-88028.htmlTue, 29 Sep 2026 16:11:32 +0000MEDIUM 6.5: Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influehttps://patchthecve.com/cve/CVE-2026-88027.htmlhttps://patchthecve.com/cve/CVE-2026-88027.htmlTue, 29 Sep 2026 16:15:26 +0000HIGH 7.1: Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user whttps://patchthecve.com/cve/CVE-2026-88022.htmlhttps://patchthecve.com/cve/CVE-2026-88022.htmlTue, 29 Sep 2026 16:51:46 +0000HIGH 7.7: Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is