Mongodb Laravel Mongodb vulnerabilities

3 vulnerabilities

Known vulnerabilities in Mongodb Laravel Mongodb, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.1CVE-2026-88027mongodblaravel_mongodb+1
EPSS score
0.27%
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.7.1CVE-2026-88028mongodblaravel_mongodb+1
EPSS score
0.42%
Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.8.4CVE-2026-88022mongodblaravel_mongodb+1
EPSS score
0.43%
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.