CVE Vulnerability Catalog

Apache NiFi Registry versions 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used these coordinates as filesystem path components without rejecting parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest, resulting in filesystem operations outside the file persistence directory.

Tanium addressed a server-side request forgery vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an improper access controls vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed a SQL injection vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an information disclosure vulnerability in Discover. Technical details were not provided in the description.

Tanium addressed an improper access controls vulnerability in Threat Response. The flaw could allow access to resources or functions without the required permissions.

Tanium addressed a SQL injection vulnerability in Asset. Technical details were not provided in the description.

Tanium addressed a SQL injection vulnerability in Asset. Technical details were not provided in the description.

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.

Apache NiFi 2.11.0 provides REST API methods to migrate the contents of a version-controlled Process Group into a Connector, but the framework authorizes both methods against the target Connector alone without evaluating access to the involved Process Groups. An authenticated user with read access to a Connector can enumerate identifiers, names, and flow registry details of version-controlled Process Groups outside their granted read policies, and a user with write access can migrate a Process Group without write access to it.

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the encapsulated components and referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result, an authenticated user with write access could modify or remove components in descendant Process Groups protected by more restrictive access policies.

OpenTelemetry-Go versions 1.5.0 through 1.44.0 emit an internal Info-level diagnostic event from sdk/trace.NewTracerProvider whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications calling otel.SetLogger to enable internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs.

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in the proposed configuration. An authenticated user authorized to modify a Connector but not to read a referenced Parameter Provider could apply Secret values backed by that Parameter Provider, and the methods accepted Asset identifiers without verifying ownership by the Connector being configured.

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected.

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This is due to insufficient authorization checks in the REST API web service. An attacker can send crafted HTTP requests to the exposed REST API port to read and modify configuration and identity data with administrative privileges.

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests including the standard Content-Encoding header indicating gzip encoding. However, the framework enforcement filter did not check multiple instances of the Content-Encoding header or non-standard gzip encoding identifiers, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.

As part of Cisco's internal security review, the Cisco Nexus Dashboard engineering team conducted a comprehensive analysis that resulted in a software hardening release. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues grouped under CWE-89.

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker can send crafted sftunnel RPCs to gain root privileges on the device and its high-availability peer. Valid administrative credentials on a managed Cisco FTD device are required.

Cisco's engineering team conducted a comprehensive internal security review of Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software, resulting in a hardening release. The vulnerabilities tracked by CVE-2026-20330 are related to improper neutralization issues grouped under CWE Pillar CWE-707.