Recent CVE class overview (2024–26)

Recent CVE class overview (2024–26)

TL;DR: Rolling list of high-impact CVE classes from 2024-26 that informed real engagements and bug-bounty payouts. Not an exhaustive catalogue — a representative shortlist with one-line “what to grep for” guidance. Pair with known-cve-triage and n-day-rapid-exploitation.

How to use

For each entry: the bug, the affected family, what changed across versions, what to fingerprint on. Use this when you encounter the affected software on an engagement to decide “is this exploitable here?”.

Web app / framework CVEs

Next.js middleware bypass — CVE-2025-29927

Affected: Next.js 12.x – 15.x. Bug: x-middleware-subrequest header value middleware:middleware:middleware:middleware:middleware (5 times) caused Next.js to skip middleware entirely → auth bypass for any route protected only by middleware. Fingerprint: X-Powered-By: Next.js or _next static asset paths. See nextjs-middleware-cve-2025-29927.

Ivanti Connect Secure / Policy Secure RCE — CVE-2025-0282 / 0283

Affected: Ivanti Connect Secure VPN. Bug: stack-based buffer overflow in HTTP/1.0 handling on the management interface; pre-auth RCE. Fingerprint: SSL banner showing Ivanti / Pulse Secure. Often paired with credential leak from /dana-na/auth/url_default/welcome.cgi.

Cleo Harmony / VLTrader / LexiCom RCE — CVE-2024-50623, CVE-2024-55956

Affected: Cleo file-transfer products. Bug: arbitrary file write through Autorun directory + path traversal. Fingerprint: TCP/5080 or HTTPS with Cleo banner.

CrushFTP RCE — CVE-2024-4040

Affected: CrushFTP 10.x < 10.7.1, 11.x < 11.1.0. Bug: server-side template injection through admin endpoints, reachable via crafted requests. Fingerprint: /WebInterface/ paths.

XZ Utils backdoor — CVE-2024-3094

Affected: xz utils 5.6.0 / 5.6.1. Bug: deliberate supply-chain backdoor in build scripts; activates only on Debian / Red Hat-based systems with sshd linked against liblzma. Fingerprint: ssh banner + xz version on the system. Critical infrastructure lesson: caught by performance regression.

libcue / GNOME tracker — CVE-2023-43641

Memory-corruption in libcue (CUE sheet parser); triggered by GNOME’s automatic indexing of downloaded files. Drive-by from any folder a user opens. Fingerprint: GNOME 3.x with default Tracker.

regreSSHion — CVE-2024-6387

Affected: OpenSSH 8.5p1 – 9.7p1. Bug: race condition in signal handling allowing pre-auth RCE. Fingerprint: SSH banner. Real exploits took 6-8 hours per target (low-success); but pre-auth RCE on OpenSSH is huge. See regression-openssh-cve-2024-6387.

glibc looney-tunables — CVE-2023-4911

Affected: glibc 2.34+. Bug: stack overflow in __tunables_init via GLIBC_TUNABLES env var; local privesc. Fingerprint: any Linux distro with affected glibc. See looney-tunables-cve-2023-4911.

Confluence — CVE-2023-22515, CVE-2023-22518, CVE-2024-21683

Affected: Atlassian Confluence Data Center / Server. Bugs in succession through 2023-24: privilege escalation, then unauth, then RCE. Fingerprint: Confluence banner; /setup/setupadministrator.action.

MOVEit Transfer — CVE-2023-34362 (and follow-ups)

Affected: Progress MOVEit Transfer. Bug: SQL injection in /moveitisapi/moveitisapi.dll; pre-auth. Used by cl0p ransomware for mass exploitation. Fingerprint: MOVEit branding on the web UI.

OS / kernel CVEs

PrintNightmare aftermath — Windows Print Spooler

CVE-2021-1675 / CVE-2021-34527 → followed by years of variants. Patch coverage incomplete; defender’s best move is to disable Print Spooler on servers that don’t need it.

Linux kernel “Dirty Pipe” — CVE-2022-0847

See dirty-pipe-cve-2022-0847.

Linux kernel netfilter LPE — CVE-2023-32233, CVE-2024-1086

Use-after-free in nftables; reliable local privesc on default kernels. Public PoCs exist; affects most kernels through early 2024.

Microsoft outlook NTLM leak — CVE-2023-23397

Affected: Outlook for Windows. Bug: a calendar item with PidLidReminderFileParameter pointing to UNC path coerces NTLM hash leak when Outlook processes the reminder. Patched but real-world abuse continued.

Apache Struts — CVE-2024-53677

OGNL eval via crafted file upload parameter. Yet another Struts file-upload RCE.

Cloud-specific CVEs

Microsoft Power Platform — multiple 2024 disclosures

Various app-isolation gaps; environment-level data leakage.

AWS — IAM trust policy parsing (research-led)

Multiple researchers showed cross-account assume-role tricks via trust policies that don’t strictly validate the principal account.

GitHub Actions — tj-actions/changed-files compromise — March 2025

See tj-actions-tag-mutation.

Cisco Identity Services Engine — CVE-2025-20281 / 20282

ISE web UI auth bypass leading to RCE on the management plane.

How to keep this list useful

This page is a snapshot. The right ongoing practice:

  1. Subscribe to vendor advisories for software in your environment.
  2. Monitor NVD / KEV (CISA Known Exploited Vulnerabilities).
  3. Watch Project Zero, Trend Micro ZDI, Pwn2Own announcements.
  4. Track which CVE classes are pre-auth, unauthenticated, network-reachable.

Working with public PoCs

For each CVE you intend to exploit:

  1. Find advisory + patch diff.
  2. Find public PoC; verify it works in a lab.
  3. Adapt to target version.
  4. Confirm pre-flight (not destructive).

See searchsploit-and-public-exploit-workflow, porting-public-exploits.

References