CVE-2026-92756

MediumCVSS 5.5/10Last modified Sep 24, 2026

Description

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

VendorProductVersions
MongoDB Inc.MongoDB Entity Framework Core Provider>= 8.0.0, < 8.4.3; >= 9.0.0, < 9.1.3; >= 10.0.0, < 10.0.3

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-927575.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable CVE-2026-927585.5If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in CVE-2026-927596.5SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the CVE-2026-927606.5Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscrCVE-2026-927618.8WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. AttCVE-2026-927628.8Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side autCVE-2026-927638.1Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.CVE-2026-927644.3OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning thCVE-2026-927656.5ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnCVE-2026-927667.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in CVE-2026-927676.4The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all veCVE-2026-927685.5A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, inclu