ThreatVectr

Vulnerabilities — Page 4

Illustration: a USB security hardware token plugged into a laptop port on a dark office desk
Vulnerabilities

A Broken Cryptographic Check in SWIFT's Login Tool Handed Attackers Full PC Control

A homemade RSA verification routine in Thales Group's SConnect software left SWIFT banking access, Qatar's national identity system, and the Swedish Tax Agency open to silent drive-by attacks. The patch is out. Most users haven't moved.

5 min read
Illustration: a dim server room with a single rack bay glowing a soft red, cables trailing across the floor
Vulnerabilities

Attackers Are Hunting a Rejetto HFS Flaw That an AI Model Found First

A session-cookie bug uncovered with Anthropic's Project Glasswing is now drawing live exploitation attempts against Rejetto's file server.

4 min read
Illustration: a dim data center aisle, rows of networking appliances with cool blue status LEDs
Vulnerabilities

Citrix NetScaler Zero-Day Is Knocking Login Systems Offline

A memory flaw in NetScaler ADC and Gateway, now exploited in the wild, can crash the gateways many companies rely on for single sign-on. US federal agencies have three days to patch.

4 min read
Illustration for the story: Fortinet FortiMail Has a Critical Zero-Day Being Exploited and No Patch Yet
Vulnerabilities

Fortinet FortiMail Has a Critical Zero-Day Being Exploited and No Patch Yet

A vulnerability scored 9.8 out of 10 in Fortinet FortiMail lets attackers write files to affected servers without logging in. Fixes are not out yet. US federal agencies had until 4 October 2026 to apply workarounds.

3 min read
Illustration: a dark server rack in a dim data centre
Vulnerabilities

Kiteworks patches critical flaw in email gateway that let attackers seize root control

A chain of three bugs in the company's Email Protection Gateway handed unauthenticated outsiders a path to full appliance takeover. The fix is in version 9.4.1.

4 min read
A server rack in a dimly lit data center, its indicator lights casting a faint blue glow across rows of black hardware
Vulnerabilities

An AI Found a Critical Security Hole in BeyondTrust. Hackers Were Inside It Four Days Later.

A new Google report shows how artificial intelligence is speeding up both the discovery of software flaws and their exploitation. One flaw found by an AI tool had attackers knocking within days of going public.

3 min read
Illustration: A physical rack-mounted network firewall appliance with blinking status LEDs in a dimly lit server room
Vulnerabilities

WatchGuard Patches Three Critical Flaws That Could Hand Attackers Full Control of Firewalls and Access Points

A clutch of serious vulnerabilities in WatchGuard's networking gear could hand attackers root-level control of firewalls and wireless access points. Patches are out, but the window between disclosure and update is where organisations get hurt.

3 min read
Illustration: a government operations desk at night, glowing amber monitor showing abstract vulnerability catalogue rows
Vulnerabilities

CISA Gives Federal Agencies Three Days to Patch Two Zammad Flaws Being Exploited Now

Two critical bugs in the Zammad helpdesk platform can be chained for root-level takeover. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 October 2026, with a patch deadline of 5 October.

3 min read
Illustration: a dimly lit server rack in a corporate data room
Vulnerabilities

GitLab patches a near-perfect-score AI Gateway bug that lets logged-in users run commands on the server

CVE-2026-90970 scores 9.9 out of 10 and lets any authenticated user with Duo Agent Platform access escape a prompt template and execute code. Only self-hosted gateways need the fix.

3 min read
Illustration: a dimly lit enterprise network operations centre, rows of server racks with amber indicator lights
Vulnerabilities

Cisco SD-WAN flaw gives attackers admin keys, and someone is already using it

CISA gave federal agencies three days to patch CVE-2026-76504 after evidence the authentication bypass is being exploited in the wild.

3 min read
Illustration for the story: Kiteworks Told Customers to Go Dark for Nine Hours After a Federal Warning
Vulnerabilities

Kiteworks Told Customers to Go Dark for Nine Hours After a Federal Warning

Fewer than 50 organisations use the affected feature. No breach has been confirmed. But the feds thought the risk serious enough to pick up the phone.

3 min read
Illustration: a dimly lit server rack in a data centre, blue and amber status LEDs glowing
Vulnerabilities

Zimbra mail server flaw exploited in the wild, Microsoft warns after weeks of quiet attacks

Microsoft Threat Intelligence says attackers used a specially crafted email to hijack Zimbra Collaboration Suite mail servers, drop web shells and steal mailbox data, before the flaw was patched.

3 min read
Illustration: a dense server rack in a dim data centre, network cables glowing faint blue under status LEDs
Vulnerabilities

OpenSSL Ships a Pile of Fixes, and a DTLS Bug That Can Spill Memory to the Wrong Side of the Wire

A dozen CVEs land in Ubuntu and Debian's OpenSSL packages at once. The one worth reading first is a DTLS handshake bug that can leak heap memory across a connection.

4 min read
Close-up overhead shot of a modern smartphone lying face-up on a dark matte desk, its screen glowing with a generic abstract interface of geometric shapes and l
Vulnerabilities

Apple Patches Actively Exploited Zero-Day Tied to WhatsApp Attack Chain

A graphics-processing flaw in iOS and macOS is being used in what Apple calls an 'extremely sophisticated' targeted attack. CISA gave US federal agencies three days to fix it.

4 min read
Illustration: a modern server-class CPU die on a green motherboard, soft blue rim light
Vulnerabilities

Linux patches two Spectre-style flaws in the kernel's BPF engine

Kernel maintainers shipped fixes for CVE-2026-64507 and CVE-2026-64508 after researchers showed old branch predictions could leak data from new code.

3 min read
© 2026 Threat Vectr