CVE Trends

CVE-2025-29927 is an authorization bypass vulnerability affecting Next.js, a React framework. It stems from the improper handling of the `x-middleware-subrequest` header. By exploiting this vulnerability, attackers can bypass authorization checks implemented in Next.js middleware. This flaw allows attackers to skip running the middleware, potentially allowing requests to bypass critical checks like authorization cookie validation before reaching routes. Self-hosted Next.js applications using Middleware are affected, specifically those relying on it for authentication or security checks. The vulnerability is fixed in Next.js versions 14.2.25 and 15.2.3.

CVE-2025-0282 is a stack-based buffer overflow vulnerability that affects several Ivanti network appliances, including Ivanti Connect Secure (versions prior to 22.7R2.5), Ivanti Policy Secure (versions prior to 22.7R1.2), and Ivanti Neurons for ZTA gateways (versions prior to 22.7R2.3). This vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on affected systems. Exploitation of this vulnerability was first observed in mid-December 2024, and Ivanti disclosed the vulnerability on January 8, 2025. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog. It appears the vulnerability is related to the handling of IFT (IF-T) connections.

CVE-2025-23120 is a vulnerability in Veeam Backup & Replication software that allows remote code execution (RCE) by authenticated domain users. It affects version 12.3.0.310 and all earlier version 12 builds. The vulnerability was discovered by Piotr Bazydlo of watchTowr. The vulnerability exists because of uncontrolled deserialization within the Veeam codebase. Specifically, it can be exploited by any user who belongs to the local users group on the Windows host of the Veeam server, or by any domain user if the server is joined to the domain. Veeam has addressed this flaw in Veeam Backup & Replication 12.3.1 (build 12.3.1.1139), and organizations are urged to apply the patch immediately.

CVE-2025-2783 is a vulnerability in Google Chrome specifically affecting Windows users. It is described as an "incorrect handle provided in unspecified circumstances in Mojo on Windows." Mojo is a collection of runtime libraries that facilitates inter-process communication (IPC). This vulnerability allowed attackers to bypass Chrome's sandbox protection. The vulnerability was exploited in the wild as part of a targeted attack dubbed "Operation ForumTroll," which targeted media outlets, educational institutions, and government organizations in Russia. The attack involved phishing emails with malicious links that, when clicked in Chrome, led to immediate infection. The exploit was designed to work with another exploit that enabled remote code execution, although the second exploit was not obtained by researchers. Google has addressed this vulnerability in Chrome version 134.0.6998.177/.178 for Windows.

CVE-2025-2857 is a security vulnerability in Mozilla Firefox that allows attackers to escape the browser's sandbox on Windows systems. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. This vulnerability is similar to CVE-2025-2783, a previously exploited zero-day vulnerability in Chrome. The flaw stems from mismanagement of system handles that inadvertently grants elevated access to unprivileged child processes. This issue exclusively affects Firefox on Windows, with other operating systems remaining unaffected.

CVE-2025-2825 affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. This vulnerability allows unauthenticated remote attackers to gain unauthorized access to the CrushFTP server. Specifically, unauthenticated HTTP requests can be made to the CrushFTP server, potentially leading to complete system compromise, unauthorized access to sensitive data, data theft or manipulation, and a breach of confidentiality, integrity, and availability.

CVE-2025-1974 is a vulnerability within the Ingress NGINX Controller for Kubernetes, specifically affecting the admission controller component. This flaw falls under a group of vulnerabilities collectively known as "IngressNightmare." The vulnerability arises because the admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject arbitrary NGINX configurations. This results in code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which could lead to a complete cluster takeover.

CVE-2025-1097 is a security vulnerability found in the ingress-nginx controller for Kubernetes. It stems from the improper sanitization of the `auth-tls-match-cn` Ingress annotation, which can be exploited to inject malicious configurations into Nginx. This vulnerability allows for arbitrary code execution within the context of the ingress-nginx controller. Furthermore, successful exploitation can lead to the disclosure of Secrets accessible to the controller, potentially granting unauthorized access to sensitive information cluster-wide.

CVE-2025-24514 is one of several critical vulnerabilities collectively named "IngressNightmare" found in the Ingress NGINX Controller for Kubernetes. This vulnerability exists in the admission controller component, which is responsible for validating incoming ingress objects. The admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject an arbitrary NGINX configuration remotely. This leads to code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, and possibly leading to complete cluster takeover.

CVE-2025-1098 is one of five critical vulnerabilities disclosed in the Ingress NGINX Controller for Kubernetes. These vulnerabilities, collectively named "IngressNightmare," could lead to unauthenticated remote code execution. The vulnerability affects the admission controller component and allows attackers to inject arbitrary Nginx configurations by sending malicious ingress objects. This can result in code execution on the Ingress NGINX Controller's pod and unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, potentially leading to a complete cluster takeover.