Skip to content

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Live incidents

Apr 7, 2025

1 new incident, 0 with updates.

Started

  • ClosedPatched

    CrushFTP: Authentication Bypass Vulnerability

    CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.

    CrushFTPClosed Apr 7, 2025