CVE-2026-20237: Improper Input Validation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20194: Incorrect Resource Transfer Between Spheres

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

PT-2026-93821

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity...

CVE-2026-92566: Server-Side Request Forgery (SSRF)

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38557)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from incorrect access control in the setStorageCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST request...

PT-2026-118160

Уязвимость платформы управления политиками соединений Cisco Identity Services Engine ISE связана с непринятием мер по защите структуры запроса SQL, Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные SQL-запросы...

PT-2026-93972

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

PT-2026-93863

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description Insufficiently protected credentials issues exist within the software. These issues fal...

PT-2026-94014

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94016

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94013

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93971

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-76451: SQL Injection: Hibernate

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76448: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-19607: Improper Authentication

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

PT-2026-93803

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the theme localization endpoints of the keycloak-services component, which manages authentication flows and themes. The system accepts arbitrary locale tags from...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...

PT-2026-93958

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An issue exists involving incorrect resource transfer between spheres. This flaw is...

CVE-2026-85732: Server-Side Request Forgery (SSRF)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...