/
criticity:high × victim_sectors:technology × latest_source_host:f5.com × limpar

Resultados

2 casos · pág. 1/1

f5.com · high

Mongoose populate() $where injection (CVE-2025-23061, CVE-2024-53900) enables RCE on Node.js servers; F5 sees mass exploitation as unlikely

F5 Labs analyzes CVE-2025-23061 and its predecessor CVE-2024-53900, a CVSS 9.0 flaw in the Mongoose MongoDB client library that allows remote code execution on Node.js API servers. The bug abuses the populate method, which accepts a $where clause containing arbitrary JavaScript. The initial fix for CVE-2024-53900 blocked only top-level $w…

CVE-2025-23061 CVE-2024-53900 technology
f5.com · high

F5 Labs CASI Leaderboard: Sugar-Coated Poison LLM attack and AI tooling flaws in Copilot, OpenClaw (CVE-2026-25253) and Claude Code (CVE-2026-21852)

F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that grad…

CVE-2026-25253 CVE-2026-21852 technology software development