CVE Vulnerability Catalog

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified CM IM & Presence Service, Cisco Unified CM Session Management Edition, and Cisco Unity Connection contain multiple vulnerabilities related to improper limitation of a pathname to a restricted directory (CWE-22). Cisco has released software hardening updates.

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, resulting in hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities relate to improper access control issues grouped under CWE-284.

Cisco conducted a comprehensive internal security review of Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified CM IM & Presence, Cisco Unified CM SME, and Cisco Unity Connection, resulting in software hardening releases. The vulnerabilities tracked by CVE-2026-76477 relate to improper neutralization of special elements used in SQL commands (CWE-89).

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, Unified CM IM & Presence, Unified CM SME, and Unity Connection, resulting in hardening releases that address multiple internally discovered vulnerabilities related to improper input validation (CWE-20).

Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).

Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

In MomoTommy file-management-system, the index/store/update/destroy functions in app/Http/Controllers/FileController.php of the Files API component lack authentication. Manipulating the Request argument allows remote invocation of these operations without login, and a public exploit is available.

In oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the save_files function in admin_class.php allows unrestricted file upload via manipulation of the Upload argument. The exploit has been published and can be launched remotely.

In oretnom23 file-management-system-php, manipulating the fid/id argument in files.php (File Management component) leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.

D365 F&O MCP Server before 1.11.0 defaults the apiKey parameter to an empty string in the official Azure deployment template. With an empty key, authentication middleware passes requests through and the server binds to 0.0.0.0, allowing unauthenticated JSON-RPC tool access and exposure of indexed X++ source snippets and metadata.

Incorrect authorization in the COM administration API of hMailServer 6.3.4 through 6.3.6 allows an account with the serveradmin role limited to a list of domains to act as the whole-server administrator over COM. Such an account can read and change every domain's accounts and mail, rename domains, map aliases, modify server settings and secrets, and create further server-administrator accounts.

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. This includes creating a domain alias for any name, renaming a domain, setting rule actions (bind-to-address, send-using-route, script-function), and setting the domain's relay host to an address on the server's own network.

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains to obtain the server administrator's authority. The DELETE /api/v1/role-assignments/{address} route checked only the credential's current authority, not the resulting authority, so such a credential could remove a narrowing role from a server-administrator-level account and then sign in as the server administrator after setting its password.

The webhook platform gateway in Nous Research Hermes Agent builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string. A route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated.

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.

A SQL injection vulnerability was identified in file-management-system-php within the save_folder, delete_folder, delete_file, file_rename, and save_files functions of admin_class.php (Folder Management component). Manipulating the name/parent_id/id/type/folder_id/description arguments allows SQL injection. The flaw can be exploited remotely and a public exploit is available.

In oretnom23 file-management-system-php, the save_user function in admin_class.php (User Account Management component) is vulnerable to SQL injection via manipulation of the name/username/password/type/id arguments. The attack is remote and a public exploit has been released.

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.