ThreatVectr
Tag

#VulnCheck

7 stories taggedVulnCheck.

Illustration: A glowing network of interconnected nodes and data pipelines rendered in deep blue and amber
Vulnerabilities

Langflow's Built-In Testing Tool Has No Password and Attackers Are Using It Right Now

Three critical flaws in the popular AI workflow builder let attackers run any code they like on your server, as root, without logging in. CISA ordered federal agencies to patch by May 26. Attackers are not waiting.

4 min read
A hacker's workstation with multiple displays showing attack logs, credential theft timelines, and server breach patterns mapped across a digital interface, red
Vulnerabilities

Hackers Are Actively Exploiting a Critical Flaw in the AI Builder Langflow

A software vulnerability scored at near-maximum severity is being used right now to break into Langflow servers and steal credentials. Over 360 attacks hit tracking sensors in the UK in a single day.

3 min read
A Ruby on Rails framework logo-adjacent visual of server logs cascading down, with red error indicators and file-access permission hierarchies highlighted
Vulnerabilities

Hackers Are Actively Exploiting a Near-Perfect-Score Flaw in Ruby on Rails

A critical vulnerability in the popular web framework lets criminals read files off a server and run their own code on it, and the official patch only closes half the door.

3 min read
Close-up of a circuit board with glowing red indicator lights and exposed firmware pathways, highlighting vulnerability points where unauthorized code could ent
Vulnerabilities

ZBT Routers Found With Two Hidden Factory Backdoors Handing Attackers Full Control

Researchers at VulnCheck say firmware shipped by Shenzhen Zhibotong Electronics contains two undocumented implants that let anyone on the internet run commands as root.

3 min read
Illustration: A developer's workspace with a Jupyter-
Vulnerabilities

Marimo Patches Notebook Flaw That Let Hidden Commands Run on Open

A high-severity bug in the Marimo notebook app could quietly run attacker-supplied commands the moment a user opened a booby-trapped file in edit mode.

3 min read
Network hardware warehouse or manufacturing facility with rows of Zbtlink routers, factory equipment and assembly lines visible, with server racks and network m
Threat Intelligence

Twenty Chinese Router Models Ship From The Factory With A Hidden Backdoor

Researchers at VulnCheck say every current Zbtlink firmware image contains an implant that phones home to Chinese servers and hands attackers root access.

4 min read
Illustration: a dimly lit server rack in a data centre, one blue status LED glowing
Vulnerabilities

Windmill Path Traversal Flaw Under Active Attack, VulnCheck Warns

CVE-2026-29059 lets unauthenticated attackers read files from servers running the open-source developer platform. Patch guidance and exploitation details below.

3 min read
© 2026 Threat Vectr