CVE Vulnerability Catalog

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 relate to protection mechanism failure and are grouped under CWE-693.

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76527 relate to improper check or handling of exceptional conditions and are grouped under CWE-703.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76408 relates to improper control of a resource through its lifetime (CWE-664).

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76407 relate to improper access control and are grouped under CWE-284.

Cisco's internal security review discovered multiple vulnerabilities related to improper neutralization (CWE-707). Fixes were released as part of a software hardening update.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76301 relates to protection mechanism failure (CWE-693).

Cisco conducted an internal security review resulting in a software hardening release. The vulnerabilities tracked by this CVE relate to improper access control and are classified under CWE-284.

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified.

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. SSH options set via set_openssh_opt do not reach this command, so no configuration restores host key checking for the transfer.

A vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to compromise confidentiality and integrity. It can be exploited through APIs in the component, such as a web service supplying data to the APIs.

In Laravel before 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account.

In TOTOLINK EX200 5.2.3c.7200, the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi of the wireless.so component is vulnerable to a stack-based buffer overflow via manipulation of the macAddress argument. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

In TOTOLINK EX200 5.2.3c.7200, the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi of the lan.so component is vulnerable to a stack-based buffer overflow via manipulation of the Comment argument. The attack can be launched remotely, and the exploit has been released to the public and may be used for attacks.

Pillow versions 11.0.0 through 13.0.0 mishandle multi-frame images (PSD, MPO, DCX, MIC). When a later frame switches to a wider mode (RGB/CMYK), the stale narrow-mode buffer is reused, causing out-of-bounds writes and crashes, and in some runtime profiles command execution.

In the webpack integration for @sentry/nextjs from 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, application middleware is skipped for every request path under a configured tunnelRoute. When an application route collides with the tunnel path, an unauthenticated request can reach that route without middleware authorization.

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This affects versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.