#vulnerabilitymanagement

Log injection turns ZooKeeper audit records into attacker-controlled text

Four SQL injection bugs in the appliance that keeps your firewall logs

Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

Session invalidation is a route problem, not a flag problem

ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed

Five ways a Groovy sandbox leaked, and what that says about sandbox design

A request smuggling flaw on an ADC is a flaw in everything behind it

A virtual machine escape is a workstation problem until CI shares the hypervisor

Zimbra's sharing features are an unauthenticated injection surface

A patched appliance can still carry a compromise. Separating version, reachability and integrity in the BeyondTrust incident.

CVE-2026-114625 scores 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0. Here is what each vector actually encodes, what the low-privilege assumption hides, and what the score cannot answer.

CVE-2026-114625 is the third exploited VeloCloud Orchestrator flaw in 2026. What changed with the authentication requirement, and what the pattern says about patch assurance.