CVE Vulnerability Catalog

Vulnerability in the certification authentication feature of IKEv2 for Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected device reload. This is due to a logic error during the certificate authentication phase of IKEv2 connection setup.

Vulnerability in Cisco ISE allows an unauthenticated, remote attacker to perform SQL injection attacks on an affected device. This is due to improper validation of user-supplied input.

Vulnerability in the EIGRP implementation in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. This is due to improper resource management when handling EIGRP update messages.

Vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization, resulting in a DoS condition. This is due to improper rate limiting for syslog message 419002.

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software is caused by improper buffer management during TLS 1.3 connection handling. An unauthenticated remote attacker can send a crafted TLS 1.3 packet through a TLS 1.3-enabled listening socket, causing the LINA process to crash and the device to reload unexpectedly (DoS).

DD-WRT firmware deployed on TP-Link TL-WR740N v1 through v4 hardware stores sensitive authentication credentials in cleartext within non-volatile memory. Exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials, and administrative passwords, which can be extracted from an SPI flash dump with physical access to the device.

HP has identified potential security vulnerabilities in HP Advance software that, under certain conditions, may enable privilege escalation, remote code execution, or arbitrary file write. The issue impacts the HP Advance server hosting the software.

Apache NiFi Registry versions 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used these coordinates as filesystem path components without rejecting parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest, resulting in filesystem operations outside the file persistence directory.

Tanium addressed a SQL injection vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed a SQL injection vulnerability in Asset. Technical details were not provided in the description.

Tanium addressed a SQL injection vulnerability in Asset. Technical details were not provided in the description.

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions.

Apache NiFi 2.11.0 provides REST API methods to migrate the contents of a version-controlled Process Group into a Connector, but the framework authorizes both methods against the target Connector alone without evaluating access to the involved Process Groups. An authenticated user with read access to a Connector can enumerate identifiers, names, and flow registry details of version-controlled Process Groups outside their granted read policies, and a user with write access can migrate a Process Group without write access to it.

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected.

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests including the standard Content-Encoding header indicating gzip encoding. However, the framework enforcement filter did not check multiple instances of the Content-Encoding header or non-standard gzip encoding identifiers, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.

As part of Cisco's internal security review, the Cisco Nexus Dashboard engineering team conducted a comprehensive analysis that resulted in a software hardening release. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues grouped under CWE-89.

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. An unauthenticated client can use DNS name compression and excessive section counts to amplify allocation before the plugin chain, so plugin-level rate limiting cannot prevent concurrent requests from exhausting memory and terminating CoreDNS. The ordinary UDP and TCP listeners are not affected because they validate the header first. This issue is fixed in version 1.14.7.