CVE Vulnerability Catalog

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. It is due to a logic error in populating group access control policies (ACPs) with OGS configured. An unauthenticated, remote attacker could send traffic that should be blocked and bypass configured access controls.

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. It is due to a logic error in populating group access control policies (ACPs) with OGS configured. An unauthenticated, remote attacker could send traffic that should be blocked and bypass configured access controls.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users outside the security group the attacker is assigned to. It exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could export users and view passwords normally not visible to administrators.

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump without authenticating and without knowing the administrative password.

A flaw has been found in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/leave/index.php. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published and may be used.

A weakness has been identified in GPAC 26.08-DEV affecting the function wait_for_header_and_parse of the file src/utils/downloader.c. Manipulation of the Content-Range argument causes an out-of-bounds read. The attack requires local access, and the exploit has been made publicly available and could be used for attacks. Upgrading to version abi-16.26 fixes this issue (patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84).

Tanium addressed a server-side request forgery vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an improper access controls vulnerability in Threat Response. Technical details were not provided in the description.

Tanium addressed an information disclosure vulnerability in Discover. Technical details were not provided in the description.

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the encapsulated components and referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result, an authenticated user with write access could modify or remove components in descendant Process Groups protected by more restrictive access policies.

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in the proposed configuration. An authenticated user authorized to modify a Connector but not to read a referenced Parameter Provider could apply Secret values backed by that Parameter Provider, and the methods accepted Asset identifiers without verifying ownership by the Connector being configured.

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.

A vulnerability was found in Open5GS up to 2.8.0 affecting the function ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c of the PFCP Handler component. The manipulation results in a null pointer dereference. The attack may be launched remotely, and the patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2.

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work and causing denial of service in applications that parse untrusted devalue data.

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients.

Mattermost Desktop App versions <=6.2 6.2.2.0 did not sufficiently restrict server-rendered content from accessing local or private network resources. The issue was reported under the Mattermost responsible disclosure policy (MMSA-2026-00698).

On affected platforms running Arista EOS with IGMP snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down.

Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir.