CVE-2026-93764

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

• CWE-312

• https://jira.mongodb.org/browse/MONGOID-5989

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93759Mongoid does not neutralize a string-typed query criterion s…8.6
• CVE-2026-9376A vulnerability was determined in JPress up to 1.0.3. The af…6.3
• CVE-2026-93760Mongoid does not restrict which query operators may come fro…8.2
• CVE-2026-93761An inefficient regular expression complexity issue in the in…7.5
• CVE-2026-93762Mongoid contains an unsafe reflection weakness in the query …9.8
• CVE-2026-93763A protection mechanism failure in the object-document mapper…6.5
• CVE-2026-93765Mongoid contains an unsafe reflection weakness in the docume…9.1
• CVE-2026-9377A vulnerability was identified in SourceCodester SUP Online …2.4
• CVE-2026-9378A security flaw has been discovered in Edimax BR-6675nD 1.12…6.3
• CVE-2026-9379A weakness has been identified in Edimax BR-6675nD 1.12. Thi…6.3
• CVE-2026-9380A security vulnerability has been detected in Edimax BR-6675…8.8
• CVE-2026-9381A vulnerability was detected in Edimax BR-6675nD 1.12. Affec…8.8