CVE-2026-92401: Improper Authentication

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continiou...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-20282: Improper Restriction of Names for Files and Other Resources

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafte...

CVE-2026-20250: Missing Release of Resource after Effective Lifetime

A vulnerability in Datagram TLS DTLS message handling of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a...

CVE-2026-20309: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

CVE-2026-20286: Improper Authorization

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20248: Signed to Unsigned Conversion Error

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the...

CVE-2026-20284: Improper Neutralization of Special Elements in Data Query Logic

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to ...

PT-2026-93975

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Cisco Secure FTD Software affected versions not specified Description An issue exists in the sftunnel inter-device communication protocol during the TLS connection setup. An...

PT-2026-93964

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks on an affected device due to improper validation of user-supplied input. By sending a crafted request, an attacker could...

PT-2026-93980

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center FMC Software affected versions not specified Description A flaw in the sftunnel inter-device communication protocol allows an authenticated remote attacker to execute arbitrary commands with root...

PT-2026-93969

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the IPsec Open API endpoint allows an authenticated remote attacker to inject arbitrary commands into the underlying operating system. This occurs due to insufficient validation...

CVE-2026-76438: Incorrect Authorization

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-92215: Server-Side Request Forgery (SSRF)

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-51990

The Sogou Input Method for Windows (versions prior to 16.3.0.3498 ) is vulnerable to a remote code execution (RCE) attack chain triggered by a specially crafted link. The attack begins when a user clicks a sgbiz: URI, causing the biz_helper.exe component to pass unvalidated command-line arguments...

CVE-2026-73173: Missing Authentication for Critical Function

Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-76439: Missing Authentication for Critical Function

A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerability is due to insufficient authenticati...

CVE-2025-56563: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-27562: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...