Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
A trivial header injection in Next.js allows attackers to skip middleware execution entirely, bypassing authentication, authorization, and security checks on any route protected only by Next.js middleware.
A deserialization vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute arbitrary code on the backup server, potentially destroying or encrypting backups before a ransomware attack.
Fortinet's critical authentication bypass in FortiOS and FortiProxy management interfaces is being actively exploited at scale, with attackers creating hidden super-admin accounts and pivoting to internal networks.
