CVE Vulnerability Catalog

Insufficient validation of directory traversal character sequences in a user-supplied path in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to access protected files. A crafted request to the provisioning download service can expose sensitive information.

Improper validation of directory traversal character sequences during file upload in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker with administrative privileges to write arbitrary files. A crafted file upload can write to arbitrary locations.

Improper validation of directory traversal character sequences in a user-supplied file path in the file management function of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to delete arbitrary files and directories. A crafted request can delete files on the underlying operating system.

SQL injection vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC due to certain parameters being concatenated directly into SQL clauses without parameterization. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the session database.

XML external entity vulnerability in the offline profiler feed service of Cisco ISE due to parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with administrative credentials can upload a crafted offline feed package to read arbitrary files and issue requests to internal systems.

SQL injection vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of specific parameters that are concatenated into an SQL statement. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the monitoring database.

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint.

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path.

A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques.

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device and using the remote diagnostics debugger to grant a user elevated privileges.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76409 are related to improper limitation of a pathname issues that are grouped under the Common Weakness Enumeration (CWE) CWE-22.

Marten from version 7.0.0 until 9.13.0 has a vulnerability involving interpolation of runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization in several LINQ and tenant-management paths. The primary confirmed vector is a dictionary indexer key used by Where filters. This could enable filter or multi-tenant authorization bypass and blind data exfiltration, and in some configurations data modification.

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app. An attacker with any TinaCloud account can submit the attacker's own app ID and valid token to a victim endpoint, causing TinaCloudBackendAuthProvider or an affected media authorized callback to accept the attacker's verified status across the tenant boundary.

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20360 are related to information exposure and insecure handling issues that are grouped under the Common Weakness Enumeration (CWE) CWE-200.

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device.

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance is due to improper validation of user-supplied input. An authenticated remote attacker can save configuration details containing malicious values, allowing injection and execution of arbitrary operating system commands with root privileges.

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack. The attacker must have a valid account with the role of Security Approver, Access Admin, or Network Admin. The issue is due to insufficient validation of user-supplied input.

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. The issue exists because a critical API lacks authentication.

A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. The issue exists because user input is not being sanitized. The attacker must have valid credentials with at least the role of Security Analyst (read-only).