Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: MongoDB Entity Framework Core Provider 10.0.4, 8.4.4, 9.1.4 Clear all filters
TI-2026-62502 CVE-2026-92757 · GHSA-r5h6-p8wg-h467

Malformed connection string may disable field level encryption

Priority LOW 28

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00067 Published 2026-09-17 Fixed in 8.4.4, 9.1.4 +1 CWE-311
TI-2026-62503 CVE-2026-92758 · GHSA-9j93-82hq-j4r5

Logs may collect sensitive information

Priority LOW 25

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.

CVSS 4.0MEDIUM 5.7 Local Low privileges No interaction EPSS 0.00151 Published 2026-09-17 Fixed in 8.4.4, 9.1.4 +1 CWE-532