I don't know if it's a bug at all: I had the Vulnerable trait attached to my character (+1 damage received), and had another Vulnerable trait on my hand. I was hit for 5, and received 7 in damage (the trait was also displayed twice). If I'd had my turn and played the trait, the newest Vulnerability would have replaced the other, but as I was attacked before I had my turn, I had the double effect in this small sliver of time. Is it how it is supposed to be (having the same trait effect twice), or a bug?
That's sort of a fringe case, but it sounds to me like it's working as intended. Vulnerability triggers both from the hand and as an attachment, in order to avoid the unfair scenario that going first in a round would cause you to hit a character before they play their traits, leading you to do less damage. What happened is that the one attached to you triggered, and since you had one in your hand it also triggered. I'd imagine that if you had multiple copies in your hand, they'd ALL trigger, even though when you get your turn you'd only end up with one copy attached to your character.