CVE-2026-92748

BC Security Empire before version 6.7.1 contains a path traversal vulnerability in its upload endpoints. The root cause is a failure to validate the multipart filename parameter , allowing authenticated operators to use path traversal sequences to write files to arbitrary locations on the C2 serv...

CVE-2026-63506

Tina (headless CMS) suffers from a broken access control in @tinacms/auth (prior to 1.1.4) and next-tinacms-azure (prior to 15.0.1). The isAuthorized function accepts a request-controlled clientID, allowing an attacker with any TinaCloud account to submit their own app ID and valid token to a vic...

CVE-2026-76426

Cisco ISE and Cisco ISE-PIC contain an SQL injection vulnerability in their REST API , caused by insufficient validation of specific parameters that are concatenated directly into an SQL statement. An authenticated, remote attacker with valid administrative credentials can send a crafted request ...

CVE-2026-20121

A logic error in the Object Group Search (OGS) implementation of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to bypass configured access controls by sending traffic that should be blocked through the device. A successful exploit could let the attacker rea...

CVE-2026-76431

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker with administrative credentials to delete arbitrary files and directories on the underlying operating system. The root cause is improper va...

CVE-2026-76427

Cisco ISE is affected by an XML External Entity (XXE) injection vulnerability in the offline profiler feed service . The root cause is an XML parser that fails to disable external entity resolution when processing feed metadata. An attacker with valid administrative credentials can upload a craft...

CVE-2026-76447

Cisco ISE and Cisco ISE-PIC contain a vulnerability in the OCSP responder caused by missing authentication on a specific function. An unauthenticated, remote attacker can send a crafted request to trigger an administrative reload of the OCSP responder certificate and key material on demand. The i...

CVE-2026-20287

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by improper privilege management vulnerabilities (grouped under CWE-269 ), discovered internally during a security hardening review. The CVSS 3.1 score is 6.5 (Medium) , with a vector of AV:N/AC:L...

CVE-2026-20285

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an authorization bypass in the web-based management interface , caused by the lack of server-side validation of Administrator permissions. An authenticated, remote attacker holding valid Administrator ...

CVE-2026-20286

Cisco Identity Services Engine (ISE) has an authorization bypass vulnerability in its web-based management interface . The root cause is the lack of server-side validation of Administrator permissions , allowing an authenticated, remote attacker with valid Administrator credentials to submit a cr...

CVE-2026-76438

CVE-2026-76438 affects the web-based management interface of Cisco BroadWorks CommPilot Application Software , where missing authorization checks allow an authenticated, remote attacker with low privileges to send a crafted HTTP request and alter configurations on select pages . The vulnerability...

CVE-2026-20072

CVE-2026-20072 is an information disclosure vulnerability in the web-based management interface of Cisco ISE . Certain files in the interface lack proper authorization enforcement, allowing an authenticated remote attacker with administrative privileges and management rights over network users to...

CVE-2026-76446

CVE-2026-76446 affects an API in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC , caused by improper restriction of XML external entity (XXE) references . An authenticated, remote attacker can send a crafted request to read specific files on the underlying operating system that the affect...

CVE-2026-20071

Cisco ISE contains a session hijack vulnerability in its SSID bring-your-own-device (BYOD) onboarding workflow . The root cause is insufficient authentication checks performed while a user is being onboarded. An unauthenticated, adjacent attacker can exploit this by spoofing the legitimate user a...

CVE-2026-76432

A directory traversal vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker with administrative-level privileges to write arbitrary files to any location on the affected system. The root cause is insufficient validation of dire...

CVE-2026-20300

Cisco Identity Services Engine (ISE) is affected by an SQL injection vulnerability caused by improper validation of user-supplied input . An authenticated, remote attacker with at least low-privileged administrative credentials can send a crafted request to read or modify data in the underlying d...

CVE-2026-76448

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by an SQL/HQL injection vulnerability caused by insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated remote attacker with v...

CVE-2026-76434

Cisco ISE and Cisco ISE-PIC contain an arbitrary file read vulnerability in the certificate import functionality of their web-based management interface. The root cause is insufficient validation of user-supplied input , allowing an authenticated, remote attacker with administrative credentials t...

CVE-2026-20120

CVE-2026-20120 affects the ACL Object Group Search (OGS) implementation in Cisco Secure Firewall ASA and FTD Software. A logic error in how group access control policies (ACPs) are populated when OGS is configured allows an unauthenticated, remote attacker to send traffic that should be blocked t...

CVE-2026-76444

CVE-2026-76444 affects an internal service in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC . The root cause is missing authentication on the Policy Runtime Repository Table (PRRT) service , allowing an unauthenticated, remote attacker to send a crafted request and retrieve sensitive con...