ThreatVectr

Vulnerabilities — Page 9

A web hosting control panel open on a monitor showing multiple website directories, with one highlighted folder containing a lock icon being bypassed, the backg
Vulnerabilities

LiteSpeed Flaw Lets a Single Hosting Account Take Over a Shared Server

cPanel warns that a critical bug in LiteSpeed Web Server Enterprise gives a low-privilege user a path to full root control, putting every website on the same machine at risk.

3 min read
An Apple device ecosystem displayed together—iPhone, iPad, and Mac—each showing the update installation screen with security patch notifications and version num
Vulnerabilities

Apple Fixes Around 200 Security Flaws in iOS 27 and macOS Golden Gate 27

The updates patch kernel vulnerabilities that could let attackers take control of a device, crash it, or quietly read private data.

3 min read
A split-screen visualization showing attack timeline accelerating on one side with AI-driven exploitation, defense response lagging on the other side, with cloc
Vulnerabilities

AI Is Cutting the Time Attackers Need to Exploit a Flaw. Defenders Haven't Caught Up.

Security vendor Picus argues defenders can no longer wait for public exploits or vendor fixes before acting.

4 min read
An e-commerce website backend showing a file upload dialog box, with PHP webshell code visible in the editor beneath, and an alert badge showing blocked attack
Vulnerabilities

WordPress plugin flaw is being used to plant hidden backdoors on shop sites

A file-upload bug in WooCommerce Wholesale Lead Capture lets attackers drop PHP webshells with no login required. Wordfence has blocked more than 100,000 attempts.

4 min read
A competitive hacking event setup with multiple workstations, live leaderboards displaying submission counts, and technical diagrams of Linux kernel architectur
Vulnerabilities

Vercel's $1 Million Sandbox Challenge Turned Up Linux Kernel Bugs Nobody Knew About

A two-week public hacking contest aimed at Vercel's AI code sandbox drew 1,285 submissions and uncovered two serious Linux kernel bugs that affect far more than one company.

4 min read
An engineering workstation with CAD software open, a browser address bar highlighted showing a suspicious login URL, and user session indicators active on the d
Vulnerabilities

Siemens patches Teamcenter login flaw that could hijack engineer sessions

A reflected cross-site scripting bug in the /auth/ endpoint lets a crafted link run attacker code inside a logged-in user's browser. Siemens has shipped fixes across four release trains.

4 min read
A server room with multiple dark tower units and blinking status lights, with one unit's access panel slightly ajar revealing the internal circuitry, suggesting
Vulnerabilities

Acronis backup add-on carries a Linux privilege flaw, and someone is already using it

A high-severity bug in Acronis backup plugins for cPanel, WHM and Plesk is being exploited in what the vendor calls limited, targeted attacks. Patches are out.

3 min read
A Pixel smartphone sitting on a desk with a security update notification displayed on its screen, surrounded by digital representations of modem vulnerabilities
Vulnerabilities

Google patches a Pixel phone flaw that hackers are already using

September update fixes 110 bugs in Pixel devices, including a modem weakness attackers can hit from nearby without a tap from the owner.

3 min read
An Oracle data center or server infrastructure with multiple systems simultaneously receiving security patches, represented by flowing update data and progress
Vulnerabilities

Oracle Fixes More Than 800 Security Flaws in Its Biggest Patch Drop of 2026

Oracle's September 2026 Critical Security Update bundles 673 patches covering over 800 vulnerabilities. More than 240 of those flaws can be exploited remotely by anyone, no password required.

3 min read
A WSO2 API Manager interface on multiple monitors with authentication token generation systems highlighted, digital signatures being forged and administrator ac
Vulnerabilities

Hackers Are Forging Admin Tokens to Take Over WSO2 API Manager

A critical signature-verification bug tracked as CVE-2026-5430 lets attackers forge login tokens and seize administrator accounts. Exploitation is already under way.

4 min read
An enterprise data center with highlighted API server infrastructure, digital locks breaking open, and credential tokens flowing through network pathways as ala
Vulnerabilities

Attackers Are Actively Exploiting a Perfect-10 WSO2 Authentication Flaw

A critical vulnerability in the WSO2 API platform, rated as severe as it gets, lets criminals forge login credentials and walk into the back end of enterprise systems. Exploitation began on September 13.

4 min read
A user at a laptop with Chrome and Firefox browser windows both open on screen, each showing update notifications or completed update confirmations displayed si
Vulnerabilities

Chrome and Firefox Fix 115 Security Flaws in Back-to-Back Updates

Google and Mozilla have each pushed out new browser versions carrying fixes for dozens of vulnerabilities, three of them rated critical in Chrome. Neither company has seen any of the flaws used in real attacks, but the advice is the same: update now.

3 min read
A WordPress admin dashboard on a computer screen showing a plugin list with one plugin highlighted in red, representing vulnerability, while warning notificatio
Vulnerabilities

Two Critical Flaws in The Events Calendar Plugin Put 200,000 WordPress Sites at Risk

Anyone can exploit the bugs without logging in, and a successful attack hands full control of a website to the attacker. Patches exist, but roughly half of all installations may not have them yet.

4 min read
A MacBook Pro laptop on a desk showing virtualization software running, with a privilege escalation vulnerability diagram and an incompatible system requirement
Vulnerabilities

Parallels Desktop Bug Hands Root to Any Mac User, and Older Macs Can't Get the Patch

A flaw in Parallels Desktop for Mac lets a normal user seize full control of the machine. The fix ships only in Parallels Desktop 27, which won't install on Intel-based Macs.

4 min read
A telecommunications server room with blinking indicator lights and cables, a computer screen in the foreground showing active system access logs and unauthoriz
Vulnerabilities

Hackers Are Actively Exploiting a Critical Issabel Flaw That Hands Over Full Server Control

CVE-2026-89026 lets unauthenticated attackers run any command they want on vulnerable phone-system servers. Attacks are already happening.

4 min read
© 2026 Threat Vectr