{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"php-mongodb","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NX24C6VCAMJ0J1FTP5VNB8","modified_at":"2026-10-06T06:00:07.228925462Z","published_at":"2026-09-24T16:17:27.293Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-96745","https://security-tracker.debian.org/tracker/CVE-2026-96745"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-96745","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-96745"}],"summary":"Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event o"}