CVE-2026-93761

HighCVSS 7.5/10Last modified Sep 24, 2026

Description

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl CVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl CVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl CVE-2026-937659.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are p CVE-2026-937676.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter CVE-2026-937697.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-admini CVE-2026-93772.4A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/pro CVE-2026-937707.1Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-937717.2Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.CVE-2026-937726.5Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.CVE-2026-937738.5Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.CVE-2026-937747.1Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.