CVE Vulnerability Catalog

A vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider allows a client to be authorized with all roles listed in an unverified JWT claim. When anonymousUserRole is set and authentication fails but falls back to anonymous, an unauthenticated client can send a forged or unsigned token with arbitrary roles and be authorized, potentially gaining super-user access.

The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.

A vulnerability in IPv4 packet processing in Cisco IOS XR Software affects ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact routers. Incorrect handling of crafted IPv4 packets processed as for-us traffic can cause network processor errors, line card reset or shutdown, and denial of service.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.

Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This is due to improper input validation for specific HTTP requests; an attacker could send a crafted HTTP request to access parts of the network beyond their intended scope.

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.

Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified CM IM & Presence Service, Cisco Unified CM Session Management Edition, and Cisco Unity Connection contain multiple vulnerabilities related to improper limitation of a pathname to a restricted directory (CWE-22). Cisco has released software hardening updates.

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, resulting in hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities relate to improper access control issues grouped under CWE-284.

Cisco conducted a comprehensive internal security review of Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified CM IM & Presence, Cisco Unified CM SME, and Cisco Unity Connection, resulting in software hardening releases. The vulnerabilities tracked by CVE-2026-76477 relate to improper neutralization of special elements used in SQL commands (CWE-89).

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, Unified CM IM & Presence, Unified CM SME, and Unity Connection, resulting in hardening releases that address multiple internally discovered vulnerabilities related to improper input validation (CWE-20).

A vulnerability in Cisco products (Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection) related to improper neutralization of input during web page generation (CWE-79, cross-site scripting). It was discovered during an internal security review and fixed in hardening releases.

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, resulting in hardening releases. CVE-2026-76474 covers internally discovered vulnerabilities related to improper authentication (CWE-287).