THREAT OPS › Threat News

Threat Intelligence News

12209 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2026-2092 (HIGH 7.7) — A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a maliciousnvd · 2026-03-18
[NVD] CVE-2026-27459 (CRITICAL 9.8) — pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Stanvd · 2026-03-18
[Breach] Infinite Campus — 137,123 accounts exposedhibp_breaches · 2026-03-18
[NVD] CVE-2026-32981 (HIGH 7.5) — A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to accenvd · 2026-03-17
Agent Commander: Promptware-Powered Command and Controlembracethered · 2026-03-17
Update: oledump.py Version 0.0.85didier_stevens · 2026-03-17
Get started with Elastic Security from your AI agentelastic_security · 2026-03-17
[NVD] CVE-2026-3644 (HIGH 7.5) — The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the ounvd · 2026-03-16
[NVD] CVE-2026-28498 (HIGH 7.5) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verificationnvd · 2026-03-16
[NVD] CVE-2026-27962 (CRITICAL 9.1) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=Nonenvd · 2026-03-16
[NVD] CVE-2026-3442 (MEDIUM 6.1) — A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful envd · 2026-03-16
[NVD] CVE-2026-3441 (MEDIUM 6.1) — A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker canvd · 2026-03-16
Update: oledump.py Version 0.0.84didier_stevens · 2026-03-14
[NVD] CVE-2026-4111 (HIGH 7.5) — A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forwnvd · 2026-03-13
[NVD] CVE-2026-4105 (MEDIUM 6.7) — A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to registenvd · 2026-03-13
[NVD] CVE-2026-32597 (HIGH 7.5) — PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token invd · 2026-03-13
[NVD] CVE-2026-23940 (MEDIUM 6.5) — Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result nvd · 2026-03-13
Update: pdf-parser.py Version 0.7.14didier_stevens · 2026-03-13
Managing Elastic Security Detection Rules with Terraformelastic_security · 2026-03-13
[NVD] CVE-2026-2229 (HIGH 7.5) — ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-dnvd · 2026-03-12
[NVD] CVE-2026-1528 (HIGH 7.5) — ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in the undici version nvd · 2026-03-12
[NVD] CVE-2026-1526 (HIGH 7.5) — The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without ennvd · 2026-03-12
[NVD] CVE-2026-32274 (HIGH 7.5) — Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sannvd · 2026-03-12
[NVD] CVE-2026-32141 (HIGH 7.5) — flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causnvd · 2026-03-12
[NVD] CVE-2025-13462 (LOW 3.3) — The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to otnvd · 2026-03-12
[NVD] CVE-2026-28356 (HIGH 7.5) — multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously cnvd · 2026-03-12
Announcing Pwn2Own Berlin for 2026zdi_blog · 2026-03-12
[NVD] CVE-2026-28384 (CRITICAL 9.9) — An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and wnvd · 2026-03-12
[NVD] CVE-2026-2514 (MEDIUM 6.1) — In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended acnvd · 2026-03-12
[NVD] CVE-2026-2513 (MEDIUM 6.1) — A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.nvd · 2026-03-12
[NVD] CVE-2026-3989 (HIGH 7.8) — SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.nvd · 2026-03-12
[NVD] CVE-2026-2366 (LOW 3.1) — A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker nvd · 2026-03-12
Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humanscloudflare_security · 2026-03-12
Study of Binaries Created with Rust through Reverse Engineeringjpcert_blog · 2026-03-12
Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humanscloudflare_security · 2026-03-12
[NVD] CVE-2026-1878 — An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race conditionnvd · 2026-03-12
[Breach] Crunchyroll — 1,195,684 accounts exposedhibp_breaches · 2026-03-12
[NVD] CVE-2026-3429 (MEDIUM 4.2) — A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the vicnvd · 2026-03-11
[NVD] CVE-2026-1524 (CRITICAL 9.8) — An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provinvd · 2026-03-11
[NVD] CVE-2025-67041 (HIGH 7.2) — An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.nvd · 2026-03-11
[NVD] CVE-2025-67038 (CRITICAL 9.8) — An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commannvd · 2026-03-11
[NVD] CVE-2025-67036 (HIGH 7.2) — An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privnvd · 2026-03-11
[NVD] CVE-2025-67035 (HIGH 7.2) — An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such nvd · 2026-03-11
[NVD] CVE-2025-67034 (HIGH 7.2) — An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.nvd · 2026-03-11
[NVD] CVE-2026-1497 (HIGH 7.2) — Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grannvd · 2026-03-11
AI Security for Apps is now generally availablecloudflare_security · 2026-03-11
AI Security for Apps is now generally availablecloudflare_security · 2026-03-11
[NVD] CVE-2026-3783 (MEDIUM 5.3) — When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .nenvd · 2026-03-11
[NVD] CVE-2026-1965 (MEDIUM 6.5) — libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connectionvd · 2026-03-11
[NVD] CVE-2026-31844 (HIGH 8.8) — An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to fnvd · 2026-03-11
[NVD] CVE-2026-23815 (HIGH 7.2) — A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.nvd · 2026-03-11
[NVD] CVE-2026-23813 (CRITICAL 9.8) — A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.nvd · 2026-03-11
[NVD] CVE-2026-31812 (MEDIUM 5.3) — Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malfnvd · 2026-03-10
[NVD] CVE-2026-29113 (MEDIUM 4.3) — Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce nvd · 2026-03-10
[NVD] CVE-2026-27214 (MEDIUM 5.5) — Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of thisnvd · 2026-03-10
[NVD] CVE-2026-21365 (MEDIUM 5.5) — Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user internvd · 2026-03-10
[NVD] CVE-2026-21364 (MEDIUM 5.5) — Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of thisnvd · 2026-03-10
[NVD] CVE-2026-21363 (MEDIUM 5.5) — Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of thisnvd · 2026-03-10
[NVD] CVE-2026-3843 (CRITICAL 9.8) — Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter innvd · 2026-03-10
[NVD] CVE-2026-23907 (MEDIUM 5.3) — This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecificationnvd · 2026-03-10
The March 2026 Security Update Reviewzdi_blog · 2026-03-10
[NVD] CVE-2025-2399 (MEDIUM 5.9) — Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW,nvd · 2026-03-10
Investigating multi-vector attacks in Log Explorercloudflare_security · 2026-03-10
Uncovering agent logging gaps in Copilot Studiodatadog_seclabs · 2026-03-10
[NVD] CVE-2026-2671 (LOW 3.1) — A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be pnvd · 2026-03-07
[NVD] CVE-2026-29786 (MEDIUM 6.3) — node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tarnvd · 2026-03-07
[NVD] CVE-2026-27137 (HIGH 7.5) — When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.nvd · 2026-03-06
[NVD] CVE-2026-29063 (CRITICAL 9.8) — Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8nvd · 2026-03-06
[NVD] CVE-2026-1468 — QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this tnvd · 2026-03-06
[NVD] CVE-2026-29074 (HIGH 7.5) — SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards againnvd · 2026-03-06
[NVD] CVE-2026-28802 (CRITICAL 9.8) — Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to tnvd · 2026-03-06
JSAC2026 -Workshop/Lightning Talk Session/Panel Discussion-jpcert_blog · 2026-03-06
[Breach] CFGI — 248,235 accounts exposedhibp_breaches · 2026-03-06
[Breach] Aura — 903,080 accounts exposedhibp_breaches · 2026-03-06
Patch diff to SYSTEMelastic_security · 2026-03-06
[NVD] CVE-2026-28474 (CRITICAL 9.8) — OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlinvd · 2026-03-05
[NVD] CVE-2026-28465 (MEDIUM 5.9) — OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwardenvd · 2026-03-05
[NVD] CVE-2026-3009 (HIGH 8.1) — A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login requestnvd · 2026-03-05
[NVD] CVE-2026-24457 (CRITICAL 9.1) — An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This invd · 2026-03-05
[NVD] CVE-2025-69534 (HIGH 7.5) — Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-convd · 2026-03-05
[NVD] CVE-2026-1605 (HIGH 7.5) — In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated nvd · 2026-03-05
On the Effectiveness of Mutational Grammar Fuzzingproject_zero · 2026-03-05
[NVD] CVE-2026-29052 (MEDIUM 6.1) — The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar mnvd · 2026-03-05
[NVD] CVE-2026-2297 — The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.nvd · 2026-03-04
Agentic Vulnerability Research with VulHuntbinarly · 2026-03-04
[NVD] CVE-2025-66024 (CRITICAL 9.0) — The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected nvd · 2026-03-04
[NVD] CVE-2026-20079 (CRITICAL 10.0) — A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  nvd · 2026-03-04
[NVD] CVE-2026-20068 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incompnvd · 2026-03-04
[NVD] CVE-2026-20067 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.  This vulnerability is due to nvd · 2026-03-04
[NVD] CVE-2026-20066 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an errnvd · 2026-03-04
[NVD] CVE-2026-20065 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an errnvd · 2026-03-04
[NVD] CVE-2026-20058 (MEDIUM 5.8) — Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. These vulnerabilities are due to improper error checking when decompressing VBA data. An attanvd · 2026-03-04
[NVD] CVE-2026-20057 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.    This vulnerability is due to lack of proper erronvd · 2026-03-04
[NVD] CVE-2026-20054 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error checking when decompressing VBA data. An atnvd · 2026-03-04
[NVD] CVE-2026-20053 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This vulnerability is due to improper range checking when decompressing VBA data, which is usnvd · 2026-03-04
[NVD] CVE-2026-20052 (MEDIUM 5.8) — A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a logic erronvd · 2026-03-04
[NVD] CVE-2026-20044 (MEDIUM 6.0) — A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root. This vulnerability is due to insufficient restrictions on remediation modules while in lockdonvd · 2026-03-04
[NVD] CVE-2026-20007 (MEDIUM 5.8) — A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Snort rules and allow traffic onto the network that should have been dropped. This vulnnvd · 2026-03-04
[NVD] CVE-2026-20006 (MEDIUM 5.8) — A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of sernvd · 2026-03-04
[NVD] CVE-2026-20005 (MEDIUM 5.8) — Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incompnvd · 2026-03-04