Base de CVEs

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76480 are related to issues with improper authentication that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-306.

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by this CVE-2026-76464 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under the Common Weakness Enumeration (CWE) CWE-787.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

Homer é um software de observabilidade de telecomunicações de código aberto. Antes da versão 11.0.283, ambas as funções de middleware JWT (JWTMiddleware e JWTMiddlewareV4) retornam imediatamente next(c) quando jwtSecret é igual a uma string vazia. O segredo JWT tem como padrão uma string vazia. Em uma instalação padrão, todos os endpoints de API protegidos sob /api/v1, /api/v3 e /api/v4 ficam totalmente sem autenticação. A versão 11.0.283 corrige o problema.

Homer é um software open source de observabilidade para telecomunicações. Antes da versão 11.0.283, em toda nova implantação do Homer que usa autenticação interna, o processo de inicialização cria automaticamente uma conta `admin` com a senha `sipcapture` (armazenada como hash SHA-256 hexadecimal legado). Não há mecanismo que force a troca da senha no primeiro login. Qualquer atacante que alcance o endpoint de login ganha imediatamente acesso administrativo completo. A versão 11.0.283 corrige o problema.

PraisonAI é um sistema de equipes multiagente. Antes da versão 4.6.78, o módulo deploy/api.py gera código de servidor Python ao interpolar diretamente o parâmetro agents_file em uma f-string, que é então gravada em um arquivo e executada via subprocess.Popen(). Um atacante que controla o valor de agents_file (via argumento de CLI, configuração ou API upstream) pode injetar código Python arbitrário. A versão 4.6.78 corrige o problema.

Uma vulnerabilidade na interface de gerenciamento baseada na web do Cisco License On-Prem, anteriormente denominado Cisco Smart Software Manager On-Prem (SSM On-Prem), poderia permitir que um atacante remoto e não autenticado obtivesse acesso não autorizado a uma aplicação afetada. Essa vulnerabilidade decorre de verificações inadequadas durante o processo de redefinição de senha. Um atacante poderia explorá-la enviando uma requisição maliciosa à interface de gerenciamento baseada na web. Uma exploração bem-sucedida poderia permitir ao atacante redefinir a senha de uma conta arbitrária, incluindo contas de administrador com altos privilégios, possivelmente permitindo acesso não autorizado à aplicação como qualquer usuário.

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Existe uma vulnerabilidade de injeção de código no script de atualização do Movable Type, que pode permitir que um atacante não autenticado execute um script Perl arbitrário ou uma consulta SQL no produto afetado.

O modo multiprocess do LMCache, também chamado de modo distribuído, abre um ROUTER ZeroMQ sem autenticação para que processos worker se registrem e compartilhem blocos de cache KV. As mensagens nesse socket são msgpack. O código de extensão 1 é passado para DeviceIPCWrapper.Deserialize, que chama pickle.loads enquanto o servidor ainda decodifica os argumentos da requisição e antes de o handler ser executado. Portanto, uma única mensagem ZMQ DEALER não autenticada enviada à porta de transporte (padrão 5555) executa código como o usuário sob o qual o processo LMCache é executado. As imagens de container oficiais executam esse processo como root. O transporte faz bind em localhost a menos que o operador defina um endereço roteável com --host, que é como implantações multi-nó permitem a conexão de peers.

Implementação incorreta de autenticação JWT/OAuth nos executores do Apache Impala nas versões até e incluindo 4.5.2, o que permite a atacantes acessar recursos servidos pelo webserver do executor quando esse webserver está configurado para aceitar tokens JWT/OAuth. As assinaturas dos tokens Bearer (JWT) não são validadas, resultando na aceitação de qualquer JWT válido. Recomenda-se aos usuários desativar a autenticação JWT/OAuth para os executores do Impala ou atualizar para a versão 4.5.3, que corrige este problema.

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.