ThreatVectr

Vulnerabilities — Page 11

A hacker's workspace with multiple monitors showing file upload interfaces and server command lines, a PHP code snippet visible on one screen, malicious activit
Vulnerabilities

Attackers Race to Exploit Elementor Pro Flaw, 190,000 Attempts Logged in Four Days

A file-upload bug in the popular WordPress plugin lets criminals plant a PHP backdoor and run commands on the server. Patch shipped August 19; attacks began the same day.

4 min read
A PostgreSQL database server interface showing vulnerability timeline spanning a decade, with a low-privilege account icon gradually escalating toward system ad
Vulnerabilities

A Ten-Year-Old PostgreSQL Flaw Let a Backup Account Become a Backdoor

A security gap in widely used database software, hidden since 2014, could let a low-level account take over an entire server. Patches are out. Here's what you need to know.

4 min read
A media server application window with security patch dialog prominently displayed, urgent notification banner across the top, user devices queued for automatic
Vulnerabilities

Plex tells users to update now as it patches unspecified security flaws

The media server company emailed customers directly, a rare step, and is holding back details until CVE numbers are assigned.

3 min read
Close-up of Surface Pro and Surface Laptop devices on a desk with error screens frozen on display, Windows Update notification visible, frustration evident thro
Vulnerabilities

Microsoft Teams and new Outlook crash on ARM Windows laptops after August updates

Surface Pro 11 and Surface Laptop 7 owners running Windows 11 24H2 hit launch failures after installing the August 2026 security updates.

4 min read
A Windows system command prompt displaying privilege escalation exploit code executing, CrowdStrike Falcon Sensor components visible in the process list, the Of
Vulnerabilities

Researcher publishes FalconFlank zero-day targeting CrowdStrike Falcon Sensor

A privilege escalation flaw abuses Falcon's own Office macro cleanup routine to hand attackers SYSTEM-level access on Windows machines.

3 min read
A WordPress admin dashboard with a backup restoration dialog box highlighted, surrounded by warning indicators and database server racks in the background
Vulnerabilities

WordPress backup plugin hole leaves 3.25 million sites open to hijack

A flaw in All-in-One WP Migration and Backup lets unauthenticated attackers plant SQL that fires when an admin restores a backup, handing over full control of the site.

4 min read
A network operations center displaying security alerts and vulnerability notifications on multiple screens, with CISA threat bulletin information visible on the
Vulnerabilities

CISA flags seven actively exploited flaws, including two in SonicWall SMA1000 boxes

The US cyber agency's Known Exploited Vulnerabilities catalog picks up bugs in Sangoma, JFrog, LiteLLM, Kestra, Starlette and a pair in SonicWall's remote access appliances.

4 min read
A manufacturing facility with industrial control systems and Rockwell Automation software displayed on control station monitors, with security update notificati
Vulnerabilities

Rockwell Automation Fixes More Than a Dozen Security Flaws Across Its Industrial Software

The manufacturing technology company has issued patches for vulnerabilities in products used to control factory equipment worldwide, including RSLinx Classic and FactoryTalk.

3 min read
A software repository server facility with glowing rack-mounted hardware and network cables, while a security alert banner scrolls across a monitoring station's
Vulnerabilities

Hackers Are Already Breaking Into Software Stores Using a Flaw Disclosed Three Days Ago

A critical security hole in JFrog Artifactory, a platform used by thousands of companies to store and ship software, is being actively exploited just 72 hours after its public disclosure.

4 min read
A cybersecurity analyst's workstation with multiple windows open showing file-transfer application code, vulnerability databases, and a functioning exploit code
Vulnerabilities

Working Exploit Published for Cleo Harmony Flaw That Ransomware Gangs Already Love

A newly discovered flaw in the Cleo Harmony file-transfer application lets attackers break in and take control without a password. A working exploit is already public, and Cl0p used a different Cleo bug to hit major organisations just months ago.

3 min read
A network security technician working at a control station with VPN authentication systems displayed, emergency patches being deployed to remote-access boxes sh
Vulnerabilities

SonicWall Patches Two VPN Zero-Days Already Being Used by Hackers

A perfect-10 flaw in SonicWall's SMA 1000 remote-access boxes lets attackers slip past the login screen, and it's being paired with a second bug in real attacks.

3 min read
A government geospatial data center with map servers and portal systems, security researchers analyzing code vulnerabilities in the open-source mapping applicat
Vulnerabilities

Two Bugs in GeoNetwork Let Attackers Take Over Government Map Portals

A chain of flaws in the open-source software behind many public geoportals allowed strangers on the internet to run their own code on the server. Fixes landed in July 2026.

3 min read
A business telephone system data center with Sangoma equipment racks, security alerts visible on monitoring stations indicating unauthorized code execution atte
Vulnerabilities

Hackers Are Breaking Into Switchvox Phone Systems Through a Critical Flaw

A severe bug in Sangoma's business phone platform lets attackers run code on servers without a password. Exploitation is already happening.

3 min read
Illustration: A server rack in dim
Vulnerabilities

22,000 Microsoft Exchange servers still open to mailbox takeover flaw

A patched but widely ignored bug lets attackers read, send and download every user's email. Exploit code is already circulating.

3 min read
A hacker's workstation with multiple displays showing attack logs, credential theft timelines, and server breach patterns mapped across a digital interface, red
Vulnerabilities

Hackers Are Actively Exploiting a Critical Flaw in the AI Builder Langflow

A software vulnerability scored at near-maximum severity is being used right now to break into Langflow servers and steal credentials. Over 360 attacks hit tracking sensors in the UK in a single day.

3 min read
© 2026 Threat Vectr