https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-93764.htmlhttps://patchthecve.com/cve/CVE-2026-93764.htmlThu, 24 Sep 2026 16:00:04 +0000MEDIUM 6.5: Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read accehttps://patchthecve.com/cve/CVE-2026-93763.htmlhttps://patchthecve.com/cve/CVE-2026-93763.htmlThu, 24 Sep 2026 16:00:39 +0000MEDIUM 6.5: A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the databhttps://patchthecve.com/cve/CVE-2026-93762.htmlhttps://patchthecve.com/cve/CVE-2026-93762.htmlThu, 24 Sep 2026 16:05:13 +0000CRITICAL 9.8: Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently https://patchthecve.com/cve/CVE-2026-93761.htmlhttps://patchthecve.com/cve/CVE-2026-93761.htmlThu, 24 Sep 2026 16:06:04 +0000HIGH 7.5: An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query conhttps://patchthecve.com/cve/CVE-2026-93760.htmlhttps://patchthecve.com/cve/CVE-2026-93760.htmlThu, 24 Sep 2026 16:07:38 +0000HIGH 8.2: Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database ehttps://patchthecve.com/cve/CVE-2026-93759.htmlhttps://patchthecve.com/cve/CVE-2026-93759.htmlThu, 24 Sep 2026 16:19:37 +0000HIGH 8.6: Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing tohttps://patchthecve.com/cve/CVE-2026-93765.htmlhttps://patchthecve.com/cve/CVE-2026-93765.htmlFri, 25 Sep 2026 14:10:39 +0000CRITICAL 9.1: Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field updahttps://patchthecve.com/cve/CVE-2026-93758.htmlhttps://patchthecve.com/cve/CVE-2026-93758.htmlFri, 25 Sep 2026 14:12:35 +0000HIGH 8.1: An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual own