ThreatVectr

Vulnerabilities — Page 5

Illustration: a dimly lit enterprise server rack with amber warning LEDs reflecting off glossy black cabinet doors
Vulnerabilities

ShinyHunters Hit Oracle PeopleSoft Bug That Hands Over the Whole System

A critical flaw in Oracle's PeopleSoft business software is under active attack, with federal agencies given days to patch.

3 min read
Illustration: a darkened laptop screen showing an abstract website admin dashboard with a glowing red cursor hovering
Vulnerabilities

Elementor Flaw Lets Attackers Hijack WordPress Sites With a Single Admin Click

A cross-site request forgery bug in the popular page-builder plugin can create rogue admin accounts if a logged-in administrator visits a booby-trapped page.

4 min read
Illustration: a dimly lit server room with rows of network equipment
Vulnerabilities

CISA Gives Federal Agencies Three Days to Patch a WSO2 Flaw Already Being Exploited

Two critical bugs are being actively exploited. Federal civilian agencies must fix the WSO2 vulnerability by September 27, and the same urgency applies to any organisation running the affected software.

3 min read
Illustration: a darkened office workstation
Vulnerabilities

A researcher keeps dropping Windows Defender zero-days, and Microsoft is losing patience

Abdelhamid Naceri's latest proof-of-concept, BigDiskBuster, stops Microsoft's built-in antivirus from updating. It is the eleventh unpatched flaw he has posted this year in a public feud with Redmond.

4 min read
Forum administrator dashboard showing active exploit code being shared publicly, vulnerability scanning results displayed with critical severity markers for unp
Vulnerabilities

WordPress 7.1.2 Patches a Critical Flaw That Attackers Started Exploiting the Same Day It Shipped

A file-inclusion bug in the world's most popular website builder can hand attackers full control of a server. The patch and the first real attacks arrived within hours of each other.

4 min read
Illustration: a modern black Android smartphone lying face up on a dark matte surface
Vulnerabilities

OnePlus phones leak text messages to any installed app, researchers warn

A flaw tracked as CVE-2025-10184 lets any app on affected OxygenOS handsets read SMS content and metadata silently, breaking one-time code security.

4 min read
Illustration: a generic black dashboard camera mounted on a car windshield at dusk
Vulnerabilities

Botslab G980H Dashcams Ship With 13 Unpatched Flaws and the Vendor Has Gone Quiet

CISA lists authentication and session bugs in a popular Chinese dashcam line. The company hasn't responded.

4 min read
Illustration for the story: Meltdown and Spectre Opened a Door That Won't Fully Close
Vulnerabilities

Meltdown and Spectre Opened a Door That Won't Fully Close

Seven years on from the chip flaws that rewrote the rules of hardware security, dozens of variants keep arriving. Here's what ordinary users need to understand about vulnerabilities baked into the silicon itself.

4 min read
Illustration: a server rack door left slightly ajar in a dim data center aisle
Vulnerabilities

Ubuntu Still Shipping a Kernel Bug That Lets Containers Break Out to Root

A use-after-free in Linux's Unix socket garbage collector was patched upstream on August 6. Ubuntu's affected LTS releases are still waiting for the fix.

4 min read
Illustration: a laptop screen showing abstract, unreadable code fragments and a partially rendered vector-graphic thumbnail
Vulnerabilities

Next.js Social Preview Feature Has a Remote Code Execution Bug

A flaw in the ImageResponse feature of Next.js lets attackers inject malicious content into SVG image generation and run arbitrary code on the server.

3 min read
Illustration: a dark server room rack with a single glowing amber ethernet port emitting soft light
Vulnerabilities

One HTTP Request Turns Bifrost AI Gateway Into a Shell

A default-off auth setting in the popular open-source AI gateway lets anyone who can reach it run programs as the server user. The fix ships in 2.1.0.

4 min read
Illustration: a dimly lit enterprise server rack with a single network orchestrator appliance glowing amber
Vulnerabilities

Arista Says a VeloCloud Orchestrator Bug Is Already Being Exploited

A remote attacker with no login can reach privileged functions on the server that runs an entire SD-WAN network. On-prem customers using certificate authentication need to act now.

3 min read
Illustration: an Arm-based server motherboard under cool blue rack
Vulnerabilities

Arm64 KVM flaw lets a guest VM reach into the host's memory

CVE-2026-89775 is a critical Linux kernel bug in the Arm64 virtualization path. A researcher says a guest can read and write host memory when nested virtualization is on.

3 min read
Illustration: a dimly lit server room with rows of dark network racks and cool blue status lights
Vulnerabilities

Microsoft Called This SharePoint Bug a Spoofing Issue. It Runs Code.

A vulnerability first rated medium turned out to let logged-in users execute code on the server. The researcher who found it just published the details.

3 min read
Illustration: a rack-mounted network switch in a dim server room, front panel activity LEDs glowing amber and green
Vulnerabilities

CISA gives federal agencies three days to patch a Zyxel switch bug already being used in attacks

CVE-2026-7273 lets anyone on the local network hijack GS1900 switches with a single crafted web request. Federal deadline: 24 September 2026.

3 min read
© 2026 Threat Vectr