ThreatVectr

Vulnerabilities — Page 19

A WordPress login page on a server with malicious code injecting itself into the authentication flow, represented by digital tendrils wrapping around the interf
Vulnerabilities

WordPress Login Flaw Lets Attackers Slip Code Into Every Site Running It

A newly disclosed bug on the WordPress sign-in page affects every version of the software and, in the wrong conditions, can hand attackers full control of the server.

3 min read
A Linux system terminal window showing kernel code from 2008 with a privilege escalation exploit running, displaying root access being granted with an alert ove
Vulnerabilities

Eighteen-Year-Old Bug in Linux Networking Code Hands Attackers the Keys to the Machine

A flaw in Linux's SCTP networking that has been sitting in the code since 2008 lets a local user become root and break out of a container. Fixed kernels shipped on 3 August.

3 min read
A security researcher's workstation with AI-assisted analysis tool running across 30,000 website scans on multiple monitors, with a new HTTP vulnerability path
Vulnerabilities

AI Research Tool Finds New Web Server Attack Tricks and an Apache Zero-Day

PortSwigger's James Kettle ran an AI-assisted system called HTTP Terminator against 30,000 sites, turned up fresh HTTP desync techniques, and then found a previously unknown flaw in Apache Traffic Server by following one of its leads by hand.

4 min read
A truck brake controller component on a workbench being examined by researchers, with technical documentation showing both recall notice and hidden security pat
Vulnerabilities

A Safety Recall on a Truck Brake Controller Was Also Quietly Fixing Security Flaws

NMFTA researchers found that a Bendix EC-80 recall patched serious software vulnerabilities, including one that could let an attacker run their own code on a commercial truck's braking system, with no cybersecurity advisory ever issued.

3 min read
A network diagram showing router NAT tables and TCP session connections being hijacked and redirected, with attackers' interception points highlighted in the da
Vulnerabilities

NatJack: New Attack Hijacks TCP Sessions by Abusing Network Address Translation

Researcher Malcolm Stagg showed at Black Hat USA 2026 how to twist NAT tables to steal live connections, fake DNS answers, and unmask hidden users.

4 min read
Network routers running Windows and Linux operating systems with their NAT translation tables being exploited to steal live TCP sessions, visualized as hijacked
Vulnerabilities

NatJack: A New Way to Hijack Internet Traffic by Poisoning Router Memory

Researcher Malcolm Stagg says routers running Windows and Linux mishandle connection tracking in ways that let attackers steal live sessions and forge DNS replies.

4 min read
A collection of device screens—laptop, tablet, smartphone—each displaying a security patch notification downloading simultaneously, with progress bars advancing
Vulnerabilities

Microsoft and Apple Rush Out Patches for Flaws That Let Attackers In Without a Password

Several of the Microsoft bugs score a perfect 10 out of 10 for severity. Apple quietly fixed a flaw that lets someone access your screen without logging in.

3 min read
A browser window showing the Chrome update notification center with multiple critical security patches listed, and system processes running in the background to
Vulnerabilities

Google Patches 41 Security Flaws in Chrome 151, Six Rated Critical

The latest Chrome update fixes a cluster of memory-safety bugs that could let attackers crash your browser or run malicious code on your device. Here is what happened and what you should do.

3 min read
A security operations center dashboard overwhelmed with thousands of vulnerability alerts and scan results covering every inch of multiple monitors, with a mana
Vulnerabilities

The Security Metric That Lies: Why Knowing Your Vulnerabilities Is Not the Same as Reducing Your Risk

Security teams are drowning in vulnerability reports yet still can't answer the one question that matters: are we actually harder to attack today than we were last year? The old way of measuring risk is the problem.

4 min read
Nested virtual machine architecture diagram visualized on a screen, with a glowing vulnerability path shown breaking through from the innermost guest layer to t
Vulnerabilities

Zapscape flaw in Linux KVM lets a rogue guest break out to the host

A newly disclosed bug in the Linux kernel's virtualization layer, tracked as CVE-2026-64561, could let an attacker inside a nested virtual machine reach the physical server underneath.

3 min read
A network operations center displaying SD-WAN infrastructure diagrams with twelve vulnerability indicators highlighted across the topology, three of them marked
Vulnerabilities

Cisco Patches a Dozen Flaws in SD-WAN and IOS XE, Three Rated Critical

An internal Cisco security review turned up 12 vulnerabilities, including three with a severity score of 9.8 out of 10, in software that runs corporate networks worldwide.

3 min read
A CPU microarchitecture diagram showing branch predictor logic with interrupts and kernel defenses visualized, a technical illustration showing the exploit wind
Vulnerabilities

Researchers Sneak Past Spectre v2 by Slipping Between the Kernel's Own Defenses

MIT CSAIL's 'Interrupt Injection' technique re-poisons the branch predictor in the tiny window after the CPU cleans it and before Linux uses it.

4 min read
Industrial control system screens for energy and water infrastructure running on displays, with a MongoDB database version number from 2020 visible in the syste
Vulnerabilities

ABB Ability Zenon ships with a MongoDB version that hasn't been patched since 2020

Industrial software used in energy and water plants bundles an old database carrying flaws that can leak memory and sidestep access controls.

3 min read
A security operations center with multiple monitors displaying vulnerability alerts and threat indicators, operators with overwhelmed expressions working throug
Vulnerabilities

The Window Between a New Vulnerability and an Active Attack Is Getting Shorter

Security teams are buried in alerts while attackers move faster than ever. The real problem isn't a shortage of warnings. It's knowing which ones actually matter before criminals act on them.

3 min read
A flowchart or process diagram displayed on a whiteboard or monitor showing five distinct phases, with only the first phase completed and checked while the rema
Vulnerabilities

Most companies understand CTEM. Almost none of them can run it.

Knowing the five phases of Continuous Threat Exposure Management is the easy part. Building a system that actually proves your defences are improving is where programmes fall apart.

4 min read
© 2026 Threat Vectr