CVE-2026-88026

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-943

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-880278.1Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for LaCVE-2026-880286.5Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel CVE-2026-880298.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-suppCVE-2026-88033.7A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/EmployeeCVE-2026-880308.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-suppliCVE-2026-880318.1Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-suppliedCVE-2026-880327.5A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while anCVE-2026-880338.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-suppliCVE-2026-880348.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplieCVE-2026-880355.5A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is acceptCVE-2026-880368.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied CVE-2026-880376.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` sho
CVE-2026-88026: Medium severity, CVSS 6.5 | Vulnix