# MongoDB Mongoid vulnerabilities Source: https://junglewise.ai/threats/technologies/mongoid Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mongoid.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 7 vulnerabilities in MongoDB Mongoid: 0 in the last 7 days and 7 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93764, was published on 18 September 2026. Nothing in the last four weeks, down from 7 vulnerabilities in the four before. 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 7 - All time: 7 (2 critical, 0 exploited in the wild) ## About MongoDB Mongoid MongoDB object-document mapper library for Ruby providing database access abstraction. ## Latest MongoDB Mongoid vulnerabilities - [CVE-2026-93764: Mongoid client-side encryption omission in embedded models](https://junglewise.ai/threats/cve-2026-93764-mongoid-may-omit-encryption-rules-for-fields-declared-on-embedded) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-93762: Mongoid unsafe reflection weakness in query path for embedded documents](https://junglewise.ai/threats/cve-2026-93762-mongoid-contains-an-unsafe-reflection-weakness-in-the-query-path) (critical, CVSS 9.8, published 18 Sep 2026) - [CVE-2026-93761: Mongoid inefficient regex complexity in query evaluation](https://junglewise.ai/threats/cve-2026-93761-an-inefficient-regular-expression-complexity-issue-in-the-in) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-93760: Mongoid query operator injection via unsanitized filter parameters](https://junglewise.ai/threats/cve-2026-93760-mongoid-does-not-restrict-which-query-operators-may-come-from) (high, CVSS 8.2, published 18 Sep 2026) - [CVE-2026-93759: Mongoid query builder NoSQL injection via string criteria](https://junglewise.ai/threats/cve-2026-93759-mongoid-does-not-neutralize-a-string-typed-query-criterion) (high, CVSS 8.6, published 18 Sep 2026) - [CVE-2026-93765: Mongoid unsafe reflection in document persistence layer](https://junglewise.ai/threats/cve-2026-93765-mongoid-contains-an-unsafe-reflection-weakness-in-the-document) (critical, CVSS 9.1, published 18 Sep 2026) - [CVE-2026-93758: Mongoid insecure direct object reference in nested attributes](https://junglewise.ai/threats/cve-2026-93758-an-insecure-direct-object-reference-in-the-nested-attributes) (high, CVSS 8.1, published 18 Sep 2026) ## Most severe MongoDB Mongoid vulnerabilities - [CVE-2026-93762: Mongoid unsafe reflection weakness in query path for embedded documents](https://junglewise.ai/threats/cve-2026-93762-mongoid-contains-an-unsafe-reflection-weakness-in-the-query-path) (critical, CVSS 9.8, published 18 Sep 2026) - [CVE-2026-93765: Mongoid unsafe reflection in document persistence layer](https://junglewise.ai/threats/cve-2026-93765-mongoid-contains-an-unsafe-reflection-weakness-in-the-document) (critical, CVSS 9.1, published 18 Sep 2026) - [CVE-2026-93759: Mongoid query builder NoSQL injection via string criteria](https://junglewise.ai/threats/cve-2026-93759-mongoid-does-not-neutralize-a-string-typed-query-criterion) (high, CVSS 8.6, published 18 Sep 2026) - [CVE-2026-93760: Mongoid query operator injection via unsanitized filter parameters](https://junglewise.ai/threats/cve-2026-93760-mongoid-does-not-restrict-which-query-operators-may-come-from) (high, CVSS 8.2, published 18 Sep 2026) - [CVE-2026-93758: Mongoid insecure direct object reference in nested attributes](https://junglewise.ai/threats/cve-2026-93758-an-insecure-direct-object-reference-in-the-nested-attributes) (high, CVSS 8.1, published 18 Sep 2026) - [CVE-2026-93761: Mongoid inefficient regex complexity in query evaluation](https://junglewise.ai/threats/cve-2026-93761-an-inefficient-regular-expression-complexity-issue-in-the-in) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-93764: Mongoid client-side encryption omission in embedded models](https://junglewise.ai/threats/cve-2026-93764-mongoid-may-omit-encryption-rules-for-fields-declared-on-embedded) (medium, CVSS 6.5, published 18 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 7 vulnerabilities in the four before. 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 7 | 2 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other MongoDB technologies - [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server): 86 vulnerabilities - [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver): 41 vulnerabilities - [MongoDB](https://junglewise.ai/threats/technologies/mongodb): 25 vulnerabilities - [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi): 8 vulnerabilities - [MongoDB Bi Connector Odbc Driver](https://junglewise.ai/threats/technologies/bi-connector-odbc-driver): 7 vulnerabilities - [MongoDB PHP Driver](https://junglewise.ai/threats/technologies/php-driver): 7 vulnerabilities - [MongoDB Compass](https://junglewise.ai/threats/technologies/compass): 6 vulnerabilities - [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt): 6 vulnerabilities - [MongoDB Python Driver](https://junglewise.ai/threats/technologies/mongodb-python-driver): 6 vulnerabilities - [MongoDB Go Driver](https://junglewise.ai/threats/technologies/go-driver): 5 vulnerabilities - [MongoDB Mongo-Express](https://junglewise.ai/threats/technologies/mongo-express): 5 vulnerabilities - [MongoDB Node.js Driver](https://junglewise.ai/threats/technologies/node-js-driver): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MongoDB Mongoid vulnerabilities", https://junglewise.ai/threats/technologies/mongoid, 13 November 2026.