CVE-2026-92805

UVdesk Community Skeleton through version 1.1.8 suffers from missing authentication and installation-state validation on wizard endpoints within ConfigureHelpdesk controller actions. An unauthenticated attacker can submit crafted requests to these wizard endpoints to repoint the database and crea...

CVE-2026-92796 Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtai...

CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92770

Harbor through 2.15.2 is affected by a scanner credential disclosure vulnerability. The root cause is an improper restriction on the q query parameter used for filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column t...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

EUVD-2026-81018

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-76426

Cisco ISE and Cisco ISE-PIC contain an SQL injection vulnerability in their REST API , caused by insufficient validation of specific parameters that are concatenated directly into an SQL statement. An authenticated, remote attacker with valid administrative credentials can send a crafted request ...

CVE-2026-76431

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker with administrative credentials to delete arbitrary files and directories on the underlying operating system. The root cause is improper va...

CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

EUVD-2026-81156

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-20300 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

EUVD-2026-81157

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

EUVD-2026-81155

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76434 Cisco Identity Services Engine Arbitrary File Read Vulnerability

A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid administrative...

CVE-2026-76434

Cisco ISE and Cisco ISE-PIC contain an arbitrary file read vulnerability in the certificate import functionality of their web-based management interface. The root cause is insufficient validation of user-supplied input , allowing an authenticated, remote attacker with administrative credentials t...

CVE-2026-76451

Cisco Identity Services Engine (ISE) and Cisco ISE-PIC contain a SQL/HQL injection vulnerability in the Certificate Management APIs, caused by insufficient validation of user-supplied input before it is used to build database queries. An authenticated, remote attacker with valid administrative cr...

EUVD-2026-81151

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76451 Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...