https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T23:06:04.766993+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-01988 bdu:2025-01988 2026-10-04T23:06:04.770066+00:00 bdu:2025-01988 https://cve.radiocsirt.org/vuln/bit-mongoose-2025-23061 BIT-mongoose-2025-23061 2026-10-04T23:06:04.770100+00:00

Affected: Bitnami: mongoose

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

 https://cve.radiocsirt.org/vuln/euvd-2026-210585 EUVD-2026-210585 2026-10-04T23:06:04.770129+00:00 EUVD-2026-210585 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23061 fkie_cve-2025-23061 2026-10-04T23:06:04.770143+00:00

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

 https://cve.radiocsirt.org/vuln/ghsa-vg7j-7cwx-8wgw GHSA-vg7j-7cwx-8wgw — Mongoose search injection vulnerability 2026-10-04T23:06:04.770162+00:00

Affected: npm: mongoose

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the `$where` operator. This vulnerability arises from the ability of the `$where` clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.