CVE Vulnerability Catalog

Cisco's internal security review identified multiple vulnerabilities in Cisco Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, IM & Presence Service, Session Management Edition, and Unity Connection. The vulnerabilities relate to improper neutralization of special elements in output used by a downstream component (CWE-74).

A vulnerability in the database service of Cisco Expressway Series is caused by the use of persistent cookies and insufficient validation of client certificates when TLS Verify Mode is enabled for clustering. An unauthenticated remote attacker with network access can connect to the database service and invoke specific RPC commands, allowing execution of arbitrary operating system commands as root.

A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client is due to insufficient validation of user-supplied input. An authenticated local attacker can send a series of crafted IPC messages to a local socket, allowing limited file write operations with SYSTEM or root privileges. On macOS and Linux, the flaw can be used to obtain full root privileges.

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.

A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.

Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device.

Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).

Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.

A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.

A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.

A vulnerability in the Snort 3 NetFlow Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing UDP Netflow Protocol packets. Sending a single crafted Netflow packet through an established connection can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 SMTP MIME Decoder of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. The flaw is due to a lack of error checking when parsing MIME fields of the SMTP header. Sending crafted SMTP packets through an established connection can cause an unexpected restart and denial of service (DoS) condition.

In MomoTommy file-management-system, the index/store/update/destroy functions in app/Http/Controllers/FileController.php of the Files API component lack authentication. Manipulating the Request argument allows remote invocation of these operations without login, and a public exploit is available.

In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.

In oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the save_files function in admin_class.php allows unrestricted file upload via manipulation of the Upload argument. The exploit has been published and can be launched remotely.

In oretnom23 file-management-system-php, manipulating the fid/id argument in files.php (File Management component) leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.