PT-2026-93811

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 6.0.1 Description An issue exists where unauthenticated attackers can execute arbitrary HTTP requests by providing a caller-controlled URI. This occurs via the '/dataSet/preview/Http' endpoint, allowing the issuance ...

CVE-2026-20130: Improper Neutralization of Special Elements in Output Used by a Downstream Component

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

PT-2026-93821

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity...

CVE-2026-92813: Server-Side Request Forgery (SSRF)

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

PT-2026-94085

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.63.19 Description Improper validation of the unspecified address 0.0.0.0 in custom GeoJSON URLs allows unauthenticated attackers to access loopback services. An attacker can save a malicious GeoJSON entry using the...

CVE-2026-79651: Uncontrolled Resource Consumption

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

PT-2026-93957

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine affected versions not specified Cisco ISE Passive Identity Connector affected versions not specified Description Improper access control issues exist within the software, categorized under CWE-284. Approximately...

PT-2026-93863

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description Insufficiently protected credentials issues exist within the software. These issues fal...

PT-2026-94014

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94016

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...

PT-2026-93973

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description Improper privilege management issues exist within the software, which are categorized...

PT-2026-93971

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-76451: SQL Injection: Hibernate

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76450: SQL Injection: Hibernate

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76448: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-20352: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this...

CVE-2026-20309: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...