MongoDB Laravel MongoDB vulnerabilities

3 CVEs affecting MongoDB Laravel MongoDB, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88028, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-88022, published 2026-09-10. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query…
CVE-2026-88028, published 2026-09-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be…
CVE-2026-88027, published 2026-09-10. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record…