Entity Framework Core Provider
by MongoDB
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-92758 | Med | 0.36 | 5.5 | 0.00 | Sep 17, 2026 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. | ||
| CVE-2026-92757 | Med | 0.36 | 5.5 | 0.00 | Sep 17, 2026 | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. | ||
| CVE-2026-92756 | Med | 0.36 | 5.5 | 0.00 | Sep 17, 2026 | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database. |
- risk 0.36cvss 5.5epss 0.00
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
- risk 0.36cvss 5.5epss 0.00
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
- risk 0.36cvss 5.5epss 0.00
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.