Mongoid — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in Mongoid, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-93759	Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist CWE-94	8.6	High	2026-09-18
CVE-2026-93760	NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard CWE-943	8.2	High	2026-09-18
CVE-2026-93761	Denial of service via unbounded regex matching in Mongoid's in-memory query matcher CWE-1333	7.5	High	2026-09-18
CVE-2026-93762	Data deletion and attribute disclosure via field-name method injection in in-memory queries CWE-470	9.8	Critical	2026-09-18
CVE-2026-93763	Silent plaintext persistence via unresolved callable database name in encryption schema map CWE-312	6.5	Medium	2026-09-18
CVE-2026-93764	Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation CWE-312	6.5	Medium	2026-09-18
CVE-2026-93765	Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation CWE-470	9.1	Critical	2026-09-18
CVE-2026-93758	Cross-principal document update, theft, and deletion via unvalidated id in nested attributes CWE-639	8.1	High	2026-09-18

All 8 known CVE vulnerabilities affecting Mongoid with full Chinese analysis, references, and POCs where available.