ThreatVectr

Vulnerabilities — Page 23

Security scanning software running analysis on a code repository displayed on a monitor, with database passwords and cloud credentials gradually becoming visibl
Vulnerabilities

The Security Scanners Protecting Your Code Could Be the Way Hackers Get In

A researcher found that five unnamed security vendors' own scanning tools could be tricked into handing over cloud passwords, production databases, and developer credentials, just by feeding them a rigged code repository.

4 min read
A vCenter login screen dissolving away to reveal immediate access to virtual machines and infrastructure behind it, representing authentication bypass
Vulnerabilities

Broadcom Patches Three Critical VMware Bugs, Including a vCenter Login Bypass

One flaw lets an attacker skip the login screen on vCenter entirely. Two more allow code execution and virtual machine escape across ESX, Workstation and Fusion.

3 min read
Illustration: A Windows 11 desktop showing system notification settings being adjusted
Vulnerabilities

Windows 11 gets a 42-fix preview update with quieter alerts and better voice control

Microsoft's optional KB5101684 preview for Windows 11 24H2 and 25H2 clears up File History backup errors, a DFS drive quirk that scared File Explorer, and a compliance bug that locked new work laptops out of company resources.

4 min read
A Firefox browser window loading a webpage with code execution happening silently in the background, affecting both the browser and Tor network overlay
Vulnerabilities

One Click on a Bad Web Page Was Enough to Break Firefox and Tor

Researchers at Nebula Security say a now-patched Firefox flaw let attackers run code just by loading a page, and it worked against Tor Browser too.

3 min read
A datacenter corridor with rows of server racks illuminated in cool blue light, a single rack highlighted with warning indicators, representing the vulnerable v
Vulnerabilities

Broadcom Patches Critical 'VM Escape' Flaw in VMware ESXi, Plus Four More Vulnerabilities

Five security flaws, three rated critical, have been fixed across VMware's most widely-used virtualisation products. One lets an attacker break out of a contained virtual machine and reach the underlying server it runs on.

3 min read
A developer's terminal window filled with command-line code execution, repository structure visible in the file tree, with critical severity badges and version
Vulnerabilities

Gitea Patches Critical Flaw That Lets Repo Users Run Shell Commands

CVE-2026-60004 carries a 9.8 CVSS score and is fixed in Gitea 1.27.1. Anyone running an older self-hosted instance should update now.

3 min read
An industrial factory floor with modern control panels and S7-series equipment displayed, a diagnostic readout on a nearby screen showing hundreds of vulnerabil
Vulnerabilities

Siemens flags hundreds of Linux flaws in its S7-1500 MFP factory controllers

The firmware inside a widely used industrial controller ships with a Linux subsystem carrying more than 300 unpatched CVEs. Siemens says a fix is coming.

4 min read
A desk with multiple Apple devices (iphone, mac, ipad) all displaying active security update notifications and progress bars, with a software update queue visib
Vulnerabilities

Apple Pushes Fixes for Hundreds of Security Flaws Across iPhones, Macs, and More

The latest software updates cover 87 flaws in iOS and 155 in macOS Tahoe, including one that lets a remote attacker corrupt the core of the operating system.

3 min read
Illustration: A home Wi-Fi router sitting on a shelf
Vulnerabilities

OpenWrt Ships Emergency Fix for Critical Router Flaw That Hands Attackers Full Control

A single crafted network request could let an intruder take over routers running vulnerable OpenWrt builds, before anyone logs in.

4 min read
A server room with multiple pieces of legacy remote management hardware still connected to the network, with a security scan overlay showing default credentials
Vulnerabilities

A 20-year-old flaw is leaking passwords from 24,000 servers online

Researchers found tens of thousands of remote server management chips exposed to the internet, many still running on the factory default password printed on the chassis.

3 min read
Computer terminal showing Linux kernel source code with highlighted vulnerability sections, surrounded by technical documentation and debugging tools in a devel
Vulnerabilities

Researcher Publishes Linux Kernel Root Exploit Built With AI Help

CVE-2026-53264, a use-after-free flaw in the kernel's traffic-control code, lets an ordinary Linux user gain full system control on CentOS Stream 9.

3 min read
Build server dashboard with warning alerts and patch deployment notifications cascading across multiple monitor displays, IT team members coordinating at workst
Vulnerabilities

JetBrains Patches Critical TeamCity Flaw That Let Attackers Run Commands Without Logging In

CVE-2026-63077 carries a 9.8 severity score and affects every on-premises version of the build server. Cloud customers were patched automatically.

3 min read
Network infrastructure diagram on a monitor displaying VeloCloud Orchestrator nodes under attack, with active exploitation indicators spreading across the syste
Vulnerabilities

Arista rushes fix for VeloCloud flaw already being used in attacks

A perfect-10 command injection bug in on-premises VeloCloud Orchestrator lets anyone on the network take over the box. Attackers found it first.

3 min read
Forum administrator dashboard showing active exploit code being shared publicly, vulnerability scanning results displayed with critical severity markers for unp
Vulnerabilities

Anyone Can Now Attack Unpatched vBulletin Forums Thanks to Public Exploit Code

Working exploit code for a critical vBulletin flaw is out in the open, and it lets a stranger run commands on the server without logging in.

3 min read
A computer monitor displaying workflow automation blocks and nodes, with one section visibly breaking through a red sandbox boundary line into unrestricted syst
Vulnerabilities

n8n Patches Sandbox Escape That Let Editors Run Commands on the Server

A flaw in the popular automation platform let anyone with workflow-editing access break out of the safe zone and run system commands. n8n has issued a fix.

3 min read
© 2026 Threat Vectr