CVE-2026-92758Medium· 5.5▾ SunlitIf logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.2%
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
entity_framework_core_provider >= 8.0.0, < 8.4.4entity_framework_core_provider >= 9.0.0, < 9.1.4entity_framework_core_provider >= 10.0.0, < 10.0.4Upgrade past the affected range:
entity_framework_core_provider 10.0.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92757Medium· 5.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
CVE-2026-92756Medium· 5.5Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored une…
CVE-2026-19502Medium· 5.5MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk
CVE-2026-18710Medium· 6.5A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization
CVE-2026-118510High· 8.8Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
CVE-2026-118581Medium· 6.5NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol