Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses...

CVE-2026-76504

creationtimestamp| type| source ---|---|--- 2026-09-30 11:42:55+00:00| seen| https://www.acn.gov.it/portale/w/cisco-rilevato-sfruttamento-in-rete-di-una-vulnerabilita-in-catalyst-sd-wan-manager 2026-09-30 12:46:40+00:00| seen|...

CVE-2026-76504: Improper Handling of URL Encoding (Hex Encoding)

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

VulnCheck KEV: CVE-2026-76504

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request...

PT-2026-103270

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager versions prior to 20.9.10.1 Cisco Catalyst SD-WAN Manager versions prior to 20.12.8.2 Cisco Catalyst SD-WAN Manager versions prior to 20.15.6.1 Cisco Catalyst SD-WAN Manager versions prior to 20.18.4.1 Cisco...

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request...

[SECURITY] Fedora 44 Update: perl-Catalyst-Plugin-Static-Simple-0.38-2.fc44

The Static::Simple plugin is designed to make serving static content in your application during development quick and easy, without requiring a single line of code from you...

[SECURITY] Fedora 43 Update: perl-Catalyst-Plugin-Static-Simple-0.38-2.fc43

The Static::Simple plugin is designed to make serving static content in your application during development quick and easy, without requiring a single line of code from you...

[SECURITY] Fedora 45 Update: perl-Catalyst-Plugin-Static-Simple-0.38-2.fc45

The Static::Simple plugin is designed to make serving static content in your application during development quick and easy, without requiring a single line of code from you...

Fedora 45 : perl-Catalyst-Plugin-Static-Simple (2026-4d5a716383)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d5a716383 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Fedora 43 : perl-Catalyst-Plugin-Static-Simple (2026-7c46481544)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c46481544 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

EUVD-2026-86474

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85491

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85491

The Catalyst::Seal library for Perl (versions before 0.03 ) contains a vulnerability where a dispatch memo is keyed solely on the request path. Because the memo does not account for state such as HTTP methods, content types, or schemes, it can provide incorrect resolution results for subsequent r...

CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85491: Incomplete Comparison with Missing Factors

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

PT-2026-98309

Name of the Vulnerable Software and Affected Versions Catalyst::Seal versions prior to 0.03 Description An issue exists where the software memoises how a path is resolved using only the request path as the key. Because action roles may depend on other state such as the HTTP method, content type,...