Short, cited digests of research and agency records, with a separate OfRoot perspective. Built for a clear first read and a direct path to the evidence.
FROM THE PRIMARY RECORDWordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes WordPress / WordPress Core; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDIvanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Ivanti / Connect Secure; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Ivanti / Connect Secure; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDGitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes GitLab / Community Edition and Enterprise Edition; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDCisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDLinux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Linux / Kernel; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDBroadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Broadcom / VMware ESX; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDAdobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Adobe / Commerce and Magento; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
FROM THE PRIMARY RECORDGoogle Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
OFROOT / WHO SHOULD REVIEW ITTeams whose inventory includes Google / Brotli; check the exact affected versions in vendor guidance.
CISA Known Exploited Vulnerabilities catalog Read brief
09
This collection shows the latest available primary-source digests in the current index. The Signal mark is labelled Brief when a checked primary-source digest is ready, or Sources when only a source reference is available. Digests are assembled automatically from approved records; they are not original reporting or full-paper reviews. How briefs are made →
MORE FROM OFROOT
A deeper look at the work behind the tools.
Explore OfRoot-authored guides on practical AI, connected systems, and the decisions behind useful software.