September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93765 Mongoid contains an unsafe reflection weakness in the document persistence layer... |
critical | 9.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
| CVE-2026-93762 Mongoid contains an unsafe reflection weakness in the query path used for embedd... |
critical | 9.8 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-89099 A race condition in the document value layer of MongoDB Server can allow concurr... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-11 | 2026-09-29 |
| CVE-2026-93393 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C... |
high | 8.1 | — | Mongodb / c driver | 2026-09-17 | 2026-09-29 |
| CVE-2026-88022 Improper neutralization of special elements in data query logic in the MongoDB i... |
high | 7.7 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88023 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / php library | 2026-09-10 | 2026-09-29 |
| CVE-2026-88024 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / rust driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88025 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88027 Improper neutralization of special elements in data query logic in the embedded-... |
high | 8.1 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / python driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88030 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / ruby driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88031 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.1 | — | Mongodb / go driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-93758 An insecure direct object reference in the nested attributes handling of the Mon... |
high | 8.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
| CVE-2026-93759 Mongoid does not neutralize a string-typed query criterion supplied to its query... |
high | 8.6 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93760 Mongoid does not restrict which query operators may come from caller-supplied fi... |
high | 8.2 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93761 An inefficient regular expression complexity issue in the in-memory query evalua... |
high | 7.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-84964 A double free in the OpenSSL-based TLS certificate revocation checking path of t... |
high | 7.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-82053 A security issue exists in MongoDB's LDAP authorization integration where pooled... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82075 An uncontrolled resource consumption weakness exists in the request-handling pat... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82071 Insufficient validation of storage engine configuration options in MongoDB Serve... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82067 Improper handling of case sensitivity in the configuration validation component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82066 A heap out-of-bounds read security issue exists in the query planning component... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82064 A security issue in MongoDB Server allows an unauthenticated network user to cau... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82061 A use-after-free security issue exists in the server's query execution memory tr... |
high | 8.1 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-88036 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88034 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\+\+ driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88033 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88032 A use-after-free in the reactive client-side encryption component of the MongoDB... |
high | 7.5 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88026 Improper neutralization of regular-expression metacharacters in the LINQ query t... |
medium | 6.5 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88028 Improper neutralization of special elements in data query logic in the polymorph... |
medium | 6.5 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-93395 A missing lower-bound validation in the bson_new_from_buffer() function of libbs... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption config... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when ge... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-92756 Applications built on MongoDB Entity Framework Core Provider which combine indep... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92758 If logging mode is set to DEBUG or a malformed MongoDB connection string is used... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92757 Applications built on MongoDB Entity Framework Core Provider which place a datab... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-84963 An incorrect numeric conversion in the JSON parsing component of the MongoDB C D... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84965 An integer wraparound in an allocation size calculation in the BSON library's JS... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84966 An incorrect numeric type conversion in the BSON document building component of... |
medium | 5.5 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84962 An unauthorized user with key vault write access may cause an authorized client... |
medium | 4.2 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.