web development

Critical Next.js Authentication Bypass Vulnerability Patched (CVE-2025-XXXX)

CVE News

Critical Next.js Authentication Bypass Vulnerability Patched (CVE-2025-XXXX)

Vercel has resolved a significant security flaw in Next.js middleware authentication, which could have allowed attackers to...

VulnNodeApp: A Purposefully Vulnerable Node.js Application for Security Training

News

VulnNodeApp: A Purposefully Vulnerable Node.js Application for Security Training

VulnNodeApp serves as an intentionally vulnerable Node.js application specifically designed for security education and training purposes. This...

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

Exploitation

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

A critical privilege escalation vulnerability, CVE-2025-0628, has been identified in the BerriAI/litellm application. This flaw allows users...

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

Exploitation

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

A critical vulnerability, CVE-2024-9701, has been identified in the Kedro ShelveStore class (version 0.19.8), a component of...

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

Exploitation

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

A high-severity vulnerability, CVE-2024-9919, has been identified in the parisneo/lollms-webui software, specifically in version V13. This vulnerability...

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

Exploitation

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

TL;DR CVE-2025-2303: A critical vulnerability in the Block Logic WordPress plugin allows authenticated attackers with Contributor-level access...

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

Exploitation

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

TL;DR CVE-2024-9880: A high-severity command injection vulnerability in Apache Pandas’ DataFrame.query function. Affected Versions: All versions up...

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

Exploitation

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

A newly disclosed vulnerability, CVE-2025-0452, has been identified in the latest version of eosphoros-ai/DB-GPT, a popular database...

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

Exploitation

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

TL;DR CVE-2025-23120: A critical remote code execution (RCE) vulnerability in Veeam Backup & Replication. Severity: 9.9 (CRITICAL)...

CVE-2025-30472 – Corosync Stack-Based Buffer Overflow Vulnerability

News

CVE-2025-30472 – Corosync Stack-Based Buffer Overflow Vulnerability

TL;DR CVE-2025-30472: A critical stack-based buffer overflow vulnerability in Corosync (up to version 3.1.9). Severity: Rated 9.0...

Microsoft Trust Signing Service Abused to Code-Sign Malware

APT-News

Microsoft Trust Signing Service Abused to Code-Sign Malware

In a concerning development, cybercriminals have been abusing Microsoft’s Trusted Signing platform to code-sign malware executables with...

CVE-2024-9847 – FlatPress CMS CSRF Attack

Exploitation

CVE-2024-9847 – FlatPress CMS CSRF Attack

A critical vulnerability, CVE-2024-9847, has been identified in FlatPress CMS, a lightweight blogging platform. The flaw, classified...

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

Exploitation

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

Vulnerability: A critical authorization bypass flaw (CVE-2025-29927) has been identified in Next.js, a popular React framework. Severity:...

web development

Critical Next.js Authentication Bypass Vulnerability Patched (CVE-2025-XXXX)

VulnNodeApp: A Purposefully Vulnerable Node.js Application for Security Training

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

CVE-2025-30472 – Corosync Stack-Based Buffer Overflow Vulnerability

Microsoft Trust Signing Service Abused to Code-Sign Malware

CVE-2024-9847 – FlatPress CMS CSRF Attack

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

You may have missed

Google Introduces Simplified End-to-End Encryption for Gmail Enterprise Users

Facial Recognition and Corporate Bans: The Case of Radio City Music Hall

Hong Kong Data Breach: 128,000 Records Exposed Due to System Neglect and Outdated Infrastructure

Oracle’s SaaS Breach Cover-Up Exposed: Evidence Contradicts Denials