707 matches found
CVE-2026-76424: Relative Path Traversal
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...
CVE-2026-76420: Improper Authorization
A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...
Cisco Secure Email Gateway SQLi (cisco-sa-esa-inj-2bLVGmhX)
According to its self-reported version, Cisco Secure Email Gateway is affected by a SQL injection vulnerability. - A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root...
CVE-2026-76687
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges o...
CVE-2026-76678
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...
EUVD-2026-79213
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges o...
EUVD-2026-79204
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
Overview On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote...
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of...
PT-2026-92447
Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...
VulnCheck KEV: CVE-2026-69255
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
Cisco AsyncOS Email Analysis Arbitrary Command Execution
The vulnerability of the email analysis mechanism of Cisco AsyncOS operating system in Cisco Secure Email protection solutions is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with roo...
Vulnerability exposure in Cisco Secure Email Gateway
Cisco has identified a vulnerability in Cisco Secure Email Gateway. This vulnerability lies in the processing of email messages within the Cisco AsyncOS software for Cisco Secure Email Gateway. It arises due to insufficient validation of incoming email messages. An unauthorized malicious actor ca...
CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...
CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...
Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...
VulnCheck KEV: CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...
PT-2026-89894
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync server daemon on TCP port 13136. The daemon...