ThreatVectr

Vulnerabilities — Page 13

A humanoid robot hand in close focus with intricate mechanical joints and articulated fingers, positioned near a small device or Bluetooth transmitter suggestin
Vulnerabilities

Bluetooth to Root: Researcher Finds Two Ways Into Unitree's G1 Humanoid

Two flaws in Unitree's G1 EDU robot hand an attacker full control of the machine, and one of them needs nothing but a Bluetooth signal.

4 min read
A software development environment displaying Git repository management interface with code diff and patch utilities visible, warning indicators appearing in th
Vulnerabilities

8,300 Gitea servers still exposed to a code injection bug attackers are already using

A flaw in Gitea's diffpatch endpoint lets low-privilege users run shell commands on the server. CISA gave federal agencies three days to patch. Most operators haven't.

3 min read
A server room or data center environment with networking equipment and cables, displaying multiple critical security patch notifications and system alerts on ma
Vulnerabilities

ServiceNow patches three top-severity flaws in its AI platform

Three of the four bugs score a maximum 10.0 on the industry severity scale, and one can be triggered by an attacker who has not logged in.

4 min read
Close-up of a circuit board with glowing red indicator lights and exposed firmware pathways, highlighting vulnerability points where unauthorized code could ent
Vulnerabilities

ZBT Routers Found With Two Hidden Factory Backdoors Handing Attackers Full Control

Researchers at VulnCheck say firmware shipped by Shenzhen Zhibotong Electronics contains two undocumented implants that let anyone on the internet run commands as root.

3 min read
A server rack with one machine highlighted in red among dozens of others, with a digital lock symbol fracturing across its surface to show vulnerability spreadi
Vulnerabilities

Critical cPanel Bug Lets a Single Hosting Customer Seize an Entire Server

A flaw in domain parking, tracked as CVE-2026-65643, could hand root control of a shared hosting server to any customer with an account on it.

4 min read
A security operations center with multiple monitors displaying continuous vulnerability scanning dashboards, showing real-time threat detection in progress rath
Vulnerabilities

Why Security Teams Are Ditching the Quarterly Scan for Something That Never Stops

A growing number of organisations are replacing old-school vulnerability scanning with a continuous approach called CTEM. The idea sounds simple. The culture change is anything but.

4 min read
A web server error page with booby-trapped image file thumbnails and malicious URL bars highlighted in red against lines of Next
Vulnerabilities

Next.js Rushes Fixes for Two Critical Bugs That Let Attackers Run Code Without Logging In

Vercel patched flaws in the popular web framework that could be triggered by a booby-trapped image or a rigged URL on Windows servers.

4 min read
A print server room with multiple networked printers and management hardware actively being accessed by unauthorized connections, shown through network packet v
Vulnerabilities

PaperCut print servers under active attack via unpatched flaw

PaperCut says hackers are breaking into print management servers using a bug that affects every version of NG and MF. Emergency patches are out.

4 min read
Industrial network gateways with Chinese manufacturer markings, surrounded by red warning symbols and lock icons showing vulnerabilities with no available patch
Vulnerabilities

CISA Warns of 13 Critical Flaws in Ebyte NA111-M Gateways, No Patch in Sight

The Chinese vendor stopped responding to coordination requests, leaving industrial network gateways exposed to remote takeover.

3 min read
A factory floor with multiple Mitsubishi automation machines frozen mid-operation, with a malformed network packet visualization traveling across the machinery,
Vulnerabilities

Mitsubishi Electric factory gear can be knocked offline by a single crafted network packet

A flaw tracked as CVE-2025-3511 lets a remote attacker freeze dozens of Mitsubishi factory automation products with one malformed UDP message, forcing a manual reset to recover.

4 min read
Illustration: A gaming desktop computer with RGB
Vulnerabilities

Microsoft Blocks a Rogue RGB Driver That Was Crashing Windows 11 Gaming PCs

A tiny driver bundled with RGB lighting peripherals was knocking Windows 11 machines offline mid-game. Microsoft is now shipping a block for it.

3 min read
Multiple server racks in a secure data center with urgent patch deployment notices displayed across monitoring dashboards, showing critical vulnerability indica
Vulnerabilities

CISA Flags Six Actively Exploited Bugs, Including a Citrix NetScaler Flaw

The U.S. cyber agency ordered federal agencies to patch fast, after evidence hackers are already breaking into Citrix, Linux and Microsoft SQL Server systems.

3 min read
A WordPress dashboard displaying the Avada theme interface, with a security vulnerability warning overlay showing code injection and unauthorized access pathway
Vulnerabilities

Critical Avada WordPress theme flaw lets attackers hijack sites with no clicks

A six-step bug chain in the popular Avada theme and Fusion Builder plugin, tracked as CVE-2026-18431, hands unauthenticated attackers full control of vulnerable WordPress sites.

3 min read
Close-up of a circuit board with memory modules and error-correction circuitry illuminated under cool blue light, showing intricate pathways and semiconductor c
Vulnerabilities

NVIDIA workstation GPUs fall to GPUThor attack that beats built-in error correction

University of Toronto researchers show a Rowhammer variant can crash Ampere-class NVIDIA cards or hand an attacker root access, and NVIDIA has now issued guidance.

4 min read
A network diagram displayed on a security operations center screen showing attack chain progression through server nodes, with two highlighted vulnerabilities c
Vulnerabilities

Hackers Are Now Chaining Two SharePoint Bugs to Take Over Servers

A public proof-of-concept turned into live attacks within a day, and researchers are watching the full two-step break-in play out in honeypots.

3 min read
© 2026 Threat Vectr