ThreatVectr

Vulnerabilities — Page 18

A timeline graphic displayed on a large monitor tracing decades of software history, highlighting ancient code libraries and print-spooler systems, Stuxnet malw
Vulnerabilities

Some of the Bugs That Hid Inside Everyday Software for Decades

From a print-spooler flaw that Stuxnet quietly exploited to a 30-year-old graphics library hole, a handful of the most stubborn software vulnerabilities ever found show how long danger can lurk unnoticed.

4 min read
A SonicWall security platform interface on a monitor marked as deprecated or retired, with critical vulnerability patches being applied to legacy infrastructure
Vulnerabilities

SonicWall Patches Critical Flaws in a Security Platform It Already Retired

Two vulnerabilities scored near-perfect danger ratings and could let criminals break into systems without a password. One of the affected products was officially shut down last October.

3 min read
Illustration: A Windows logo surrounded by cascading code fragments and system error warnings
Vulnerabilities

Windows kernel bug already under attack as Microsoft ships nearly 400 fixes

A flaw in a core Windows networking component is being used in real attacks to hand attackers full control of a machine.

3 min read
A firewall interface frozen mid-crash with error messages, surrounded by incoming attack vectors represented as red network pathways converging on the device
Vulnerabilities

Cisco firewalls are being crashed through a VPN flaw, and the fix is a full software upgrade

A high-severity bug in Cisco's Secure Firewall ASA and FTD software lets attackers reboot devices remotely with a single crafted web request. Cisco says the attacks started in August.

4 min read
A Windows Update installation dialog displaying KB5120249 patch details against a clean, neutral desktop environment with security indicators illuminated
Vulnerabilities

Windows 10 gets its August 2026 security patch: what KB5120249 actually fixes

Microsoft's monthly update fixes silent backup failures and widens the Secure Boot certificate rollout. Install it now.

3 min read
A calendar or timeline showing August 2026 Patch Tuesday with 400 security fixes represented as blocks, three glowing zero-day warnings prominently featured, an
Vulnerabilities

Microsoft's August Patch Tuesday: 400 fixes, three zero-days, and Lazarus back in the frame

Microsoft ships fixes for 400 flaws, including one AFD.sys hole North Korean hackers were already using to plant a kernel rootkit.

4 min read
A SharePoint server interface with authentication mechanism broken, showing unauthorized access pathways and AI chain-attack visualization flowing through multi
Vulnerabilities

SharePoint Flaw Lets Attackers Log In as Anyone. Microsoft Patches CVE-2026-55040.

Researchers used an AI agent to help chain bugs in Microsoft SharePoint into an unauthenticated takeover. The flaw carries a CVSS score of 9.1 and affects three server editions still widely used across government and enterprise.

3 min read
Adobe Creative Suite and business software icons surrounded by critical severity warning symbols and red alert notifications, with patch installation prompts di
Vulnerabilities

Adobe Patches Over 50 Flaws, Tells ColdFusion and Campaign Classic Users to Act Now

Several of Adobe's most widely used business tools carried perfect-ten severity scores this week. Two products have been flagged as likely targets, and Adobe is telling administrators to patch immediately.

3 min read
A video conferencing window with annotation tools highlighted as the attack vector, malicious code execution path visible flowing from the annotation feature to
Vulnerabilities

Zoom Had a Flaw That Let Hackers Take Over Your Computer During a Meeting, Without You Clicking Anything

A vulnerability in Zoom's annotation feature gave attackers a direct path to run code on any participant's machine. Patches are out now.

3 min read
SAP software dashboard displaying August 2026 patch notifications with four critical vulnerabilities highlighted in red, perfect-ten severity authentication byp
Vulnerabilities

SAP Patches Four Critical Flaws on August 2026 Patch Day, Including a Perfect-10 Severity Bug

A maximum-severity authentication bypass in SAP Commerce Cloud leads a batch of 28 new security fixes. Organisations running SAP software should patch now.

3 min read
Close-up of a SIM card positioned inside EV charger or industrial equipment cellular module, with malicious code visualization showing how the compromised SIM e
Vulnerabilities

Malicious SIM cards can hijack the modems inside EV chargers and industrial gear, researchers find

A team at the University of Birmingham showed that a booby-trapped SIM can run attacker code on the cellular modules baked into cars, routers and chargers.

3 min read
A server room with rows of blinking rack-mounted equipment, one unit highlighted with a red warning indicator among dozens of others still operating normally, d
Vulnerabilities

Ransomware crews are now breaking into SharePoint servers through a May flaw

CISA says criminals are using CVE-2026-45659 to plant ransomware on unpatched Microsoft SharePoint servers. Over 200 remain exposed online.

4 min read
A USB port on the side of a laptop with a generic black USB stick partially inserted, the computer's screen in the background showing Windows 11 boot process or
Vulnerabilities

Plug-and-Play Trick Turns a Fake USB Stick Into Full Windows 11 Takeover

Researchers show how Windows' habit of auto-installing driver software can be twisted into SYSTEM-level control, no physical hardware required, and it works over Remote Desktop too.

4 min read
A WordPress admin dashboard displaying installed plugins including Element Pack, a hidden admin account notification visible in a suspicious log entry, maliciou
Vulnerabilities

Hackers hijacked BdThemes WordPress plugins to quietly create secret admin accounts

A poisoned promotional feed pushed malicious code to admin dashboards, spawning hidden accounts on sites running Element Pack and other BdThemes plugins.

3 min read
A darkened computer workspace with an iPhone displayed on a stand, sophisticated hacking tool interfaces visible on surrounding screens, subtle indicators of cr
Vulnerabilities

Two iPhone Exploit Tools Once Owned by Governments Are Now in the Hands of Ordinary Criminals

Coruna and DarkSword, sophisticated iPhone attack kits that began as nation-state spy tools, are spreading fast. Security researchers have found roughly 17,000 websites hosting them, and criminals are already making them worse.

3 min read
© 2026 Threat Vectr