CVE Vulnerability Catalog

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software is due to logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request when connecting to the SSL VPN and cause the device to reload.

VeloCloud Orchestrator (VCO) on-prem has a security issue that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user, accessing functionality intended for internal use only and not meant to be remotely accessible.

A buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

PHP has global state that temporarily points into request memory. In some scenarios, this state may not be correctly reset or may be repopulated after reset, referring to freed request memory. Subsequent requests may read or branch on this stale state before full initialization, potentially leading to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors, which may leave request memory in an uninitialized state before allocation. Subsequent request cleanup may read or branch on this memory, and multiple OOM strategies can consistently trigger this condition, leading to remote code execution (RCE).

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

The vulnerability exists within internal components of BeyondTrust's Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Siemens Software Center (all versions < V4.0.9.8) loads dynamic-link libraries (DLLs) from an uncontrolled search path. An authenticated local attacker can place a specially crafted DLL in a directory searched by the application, leading to arbitrary code execution with the application's privileges.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted.

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. It is due to improper handling of email attachments when the file reputation service is enabled; an attacker could send an email with a crafted attachment through an affected device, potentially allowing arbitrary file writes and command execution with root privileges.

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

GitLab CE/EE versions from 19.2 to 19.2.8, 19.3 to 19.3.5, and 19.4 to 19.4.2 contain a vulnerability that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. The issue stems from insufficient validation of regular expressions in CI/CD configuration.

An Arbitrary File Access vulnerability in Atlassian products (Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, Fisheye) allows an unauthenticated attacker to access specific files within the web application root directory. Exploitation requires prior knowledge of the target file's exact name and path; directory enumeration is not possible. In some configurations, sensitive files may be present, making this highly severe.

A flaw was found in AhsayCBS up to 9.15.2.69/10.3.4.44 affecting the Replication Receiver component in /rps/api/json/UpdateReceivers.do. Manipulating the 'random' argument can lead to OS command injection, and the attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in AhsayCBS up to 9.15.2.69/10.3.4.44 affecting the checkSysPwd function in com/ahsay/obs/api/ApiStructsAction.java of the API component. Manipulating the 'random' argument results in improper authentication, and the attack can be initiated remotely. The exploit is now public and may be used.

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

A path traversal vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions) allows an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.