SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
CISA Issues Warning: Ongoing Attacks Exploiting Ruby on Rails Path Traversal Bug
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning about an actively exploited path traversal vulnerability in the Ruby on Rails framework. Tracked as CVE-2019-5418, this flaw allows attackers to access arbitrary files on target servers. Given the active exploi...
CVE Research
ClamAV 1.4.3 and 1.0.9 Released: Addressing Critical RCE Vulnerability
The ClamAV team has released versions 1.4.3 and 1.0.9, critical security patches that address CVE-2025-20260 vulnerabilities that could compromise system security. These releases address a severe buffer overflow vulnerability and other significant issues. Let’s explore the details of these updates a...
CVE Research
FortiFlaw: Critical Stack-Based Buffer Overflow in Multiple Fortinet Products
A critical zero-day vulnerability, tracked as CVE-2025-32756 and assigned a CVSS score of 9.8, has been discovered in several Fortinet products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This flaw allows remote, unauthenticated attackers to execute arbitrary code or ...
CVE Research
Critical Flaws in NetScaler ADC & Gateway: CVE-2025-5349 and CVE-2025-5777
Two critical vulnerabilities have been identified in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), posing significant risks to enterprise networks. Let’s dive into the details of CVE-2025-5349 and CVE-2025-5777 and the necessary steps for remediation.
CVE Research
Microsoft Patches 72 Flaws, 5 Zero Days in May 2025 Patch Tuesday
Microsoft has released its May 2025 Patch Tuesday updates, addressing many vulnerabilities across its product lineup. This month’s release tackles 72 flaws, focusing on five zero-day vulnerabilities that are reportedly actively exploited in the wild. Additionally, two other vulnerabilities were publ...
CVE Research
Top 10 Cloud Misconfigurations to Avoid
Cloud misconfigurations remain one of the most exploited weaknesses in enterprise infrastructure. According to the IBM X-Force Threat Intelligence Index 2024, misconfigured cloud services were involved in nearly 25% of cloud security incidents, second only to stolen credentials. These are not advanc...
CVE Research
What Might Be a Phishing Message?
Phishing remains one of the most common and dangerous cybersecurity threats facing individuals and organizations today. It’s often the entry point for more serious attacks, including ransomware, data theft, and business email compromise.
CVE Research
Vulnerability Management vs. Exposure Management: What’s the Difference
In the world of cybersecurity, there’s always a new buzzword, but some trends are more than just hype. Over the last couple of years, “exposure management” has been quietly gaining traction. While most organizations still rely on traditional vulnerability management to keep threats at bay, the reali...
