CVE Vulnerability Catalog

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20360 are related to information exposure and insecure handling issues that are grouped under the Common Weakness Enumeration (CWE) CWE-200.

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device.

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack. The attacker must have a valid account with the role of Security Approver, Access Admin, or Network Admin. The issue is due to insufficient validation of user-supplied input.

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. The issue exists because a critical API lacks authentication.

A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. The issue exists because user input is not being sanitized. The attacker must have valid credentials with at least the role of Security Analyst (read-only).

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. The issue is due to unsecured deserialization of web-management user-controlled data. The attacker must have valid credentials with at least the role of Security Analyst (read-only).

A vulnerability in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software relates to improper control of a resource through its lifetime, grouped under CWE-664. It was discovered during an internal security review and addressed in a software hardening release.

A vulnerability in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software relates to incorrect calculation issues, grouped under CWE-682. It was discovered during an internal security review and addressed in a software hardening release.

Vulnerability in Cisco Secure ASA, FTD, and FMC software due to improper adherence to coding standards (CWE-710). It was discovered during an internal security review and addressed in a hardening release.

Vulnerability in Cisco Secure ASA, FTD, and FMC software due to incorrect comparison conditions (CWE-697). It was discovered during an internal security review and addressed in a hardening release.

Vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC and FTD Software allows an unauthenticated, adjacent attacker to impersonate the peer device and gain access at the manager role level (root). This is due to improper management of the TLS certificate for the sftunnel connection.

Vulnerability in Cisco ISE allows an authenticated, remote attacker to perform SQL injection attacks on an affected device. Low-privileged administrative credentials are required. This is due to improper validation of user-supplied input.

Vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC and FTD Software allows an unauthenticated, remote attacker to exhaust the available memory of an affected device. This is due to improper management of memory resources during sftunnel TLS connection setup.

Vulnerability in DTLS message handling of Cisco Secure Firewall ASA and FTD Software for 3100 and 4200 Series devices allows an unauthenticated, remote attacker to cause a DoS condition. This is due to improper resource management when processing certain DTLS messages.

Vulnerability in the certification authentication feature of IKEv2 for Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected device reload. This is due to a logic error during the certificate authentication phase of IKEv2 connection setup.

Vulnerability in Cisco ISE allows an unauthenticated, remote attacker to perform SQL injection attacks on an affected device. This is due to improper validation of user-supplied input.

Vulnerability in the EIGRP implementation in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. This is due to improper resource management when handling EIGRP update messages.

Vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization, resulting in a DoS condition. This is due to improper rate limiting for syslog message 419002.

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software is caused by improper buffer management during TLS 1.3 connection handling. An unauthenticated remote attacker can send a crafted TLS 1.3 packet through a TLS 1.3-enabled listening socket, causing the LINA process to crash and the device to reload unexpectedly (DoS).