https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84962.htmlhttps://patchthecve.com/cve/CVE-2026-84962.htmlThu, 17 Sep 2026 14:00:40 +0000MEDIUM 4.2: An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.https://patchthecve.com/cve/CVE-2026-84971.htmlhttps://patchthecve.com/cve/CVE-2026-84971.htmlThu, 17 Sep 2026 13:59:13 +0000MEDIUM 6.5: Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control thttps://patchthecve.com/cve/CVE-2026-81523.htmlhttps://patchthecve.com/cve/CVE-2026-81523.htmlThu, 17 Sep 2026 13:59:18 +0000MEDIUM 4.4: A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of info