SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
CrushFTP Security Alert: Actively Exploited Authentication Bypass Vulnerability! Patch Now!
CrushFTP users beware!! A severe authentication bypass vulnerability is exploited, endangering sensitive data and entire systems. This security flaw grants unauthorized access to CrushFTP servers, requiring urgent attention and immediate action. If you depend on CrushFTP for file transfers, recogniz...
CVE Research
Hook, Line, and Sinker: Chrome Patches Zero-Day Used in Phishing Attacks
In mid-March 2025, a deluge of personalized phishing emails took Russia by storm. When analyzed, the underlying vulnerability had researchers swimming in uncharted waters; they had found a new Chrome zero-day!
CVE Research
Ingress NGINX Remote Code Execution Vulnerabilities Discovered – Patch Now!
Critical security vulnerabilities have been discovered in the Ingress-NGINX Controller for Kubernetes. CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974—collectively known as ‘IngressNightmare’—allow attackers to gain unauthorized access to secrets across all namespaces. This results i...
CVE Research
Advancing Cloud Security in Healthcare for Resilient Data Protection
Sensitive patient data is highly valuable on the black market, subjecting the healthcare sector to frequent cyberattacks. That’s why bolstering cloud security in healthcare should be on top of healthcare IT’s (HIT) priority list. Data breaches, operational disruptions, and ransomware attacks can sev...
CVE Research
Advancing Cloud Security with a Prevention-Centric CNAPP Approach
While cloud-native application protection platforms (CNAPPs) have been widely adopted as a baseline for securing cloud environments, their inherent dependence on alerting and remediation creates gaps in protection. Zero-day vulnerabilities, misconfigurations, and supply-chain attacks are examples of...
CVE Research
15 Cloud Security Challenges
Cloud adoption can feel like navigating uncharted territory — brimming with potential but fraught with hidden dangers. Cloud security challenges such as vulnerabilities in APIs and configuration missteps can turn the cloud’s openness into a double-edged sword. As cloud adoption accelerates, so do th...
CVE Research
Zero-Day Chaos: VMware Users Urged to Patch Critical Security Flaws
Broadcom has rolled out critical security updates to patch three actively exploited zero-day vulnerabilities in VMware products, and if you’re running ESXi, Workstation, Fusion, Cloud Foundation, or Telco Cloud Platform. These aren’t just any bugs; they’re serious flaws that attackers are already us...
CVE Research
Elastic Fixes Critical Kibana RCE Vulnerability (CVE-2025-25015) – Patch Now!
A critical security vulnerability has been uncovered in Kibana. Tracked as CVE-2025-25015 (CVSS 9.9), the vulnerability arises from prototype pollution, which could allow attackers to execute arbitrary code on affected systems, thus posing a serious risk to businesses that employ Kibana for monitori...
CVE Research
Home Run! Out-Of-Bounds Write Discovered In FreeType
The FreeType font rendering library is vulnerable! CVE-2025-27363, which boasts a CVSS score of 8.1, could result in a developer’s worst nightmare: arbitrary code execution by a remote, unauthenticated attacker. The vendor has acknowledged that this out-of-bounds write flaw may have been actively ex...