/
data_types_exposed:session_tokens × latest_source_host:f5.com × limpar

Resultados

2 casos · pág. 1/1

f5.com · exploit público critical

Drupal Core CVE-2026-9082 JSON:API pre-auth SQL injection actively exploited within days of disclosure

CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…

CVE-2026-9082
f5.com · high

F5 Labs CASI Leaderboard: Sugar-Coated Poison LLM attack and AI tooling flaws in Copilot, OpenClaw (CVE-2026-25253) and Claude Code (CVE-2026-21852)

F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that grad…

CVE-2026-25253 CVE-2026-21852 technology software development