Common Weakness Enumeration
CWE-703
DiscouragedImproper Check or Handling of Exceptional Conditions
Abstraction: Pillar · Status: Incomplete
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
239 vulnerabilities reference this CWE, most recent first.
CVE-2026-32641 (GCVE-0-2026-32641)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:32 – Updated: 2026-09-21 20:48
VLAI
EPSS
VEX
Title
Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
Summary
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:13 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/parseablehq/parseable/security… | x_refsource_CONFIRM |
| https://github.com/parseablehq/parseable/pull/1581 | x_refsource_MISC |
| https://github.com/parseablehq/parseable/commit/6… | x_refsource_MISC |
| https://github.com/parseablehq/parseable/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| parseablehq | parseable |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:13:20.946272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:48:52.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "parseable",
"vendor": "parseablehq",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:32:02.658Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx"
},
{
"name": "https://github.com/parseablehq/parseable/pull/1581",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/parseablehq/parseable/pull/1581"
},
{
"name": "https://github.com/parseablehq/parseable/commit/6c583081a4161476128f330b9bb71ed7305eecde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/parseablehq/parseable/commit/6c583081a4161476128f330b9bb71ed7305eecde"
},
{
"name": "https://github.com/parseablehq/parseable/releases/tag/v3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/parseablehq/parseable/releases/tag/v3.0.0"
}
],
"source": {
"advisory": "GHSA-x4q9-j9qh-3rpx",
"discovery": "UNKNOWN"
},
"title": "Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32641",
"datePublished": "2026-09-18T17:32:02.658Z",
"dateReserved": "2026-03-12T15:29:36.560Z",
"dateUpdated": "2026-09-21T20:48:52.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31794 (GCVE-0-2026-31794)
Vulnerability from cvelistv5 – Published: 2026-03-10 18:02 – Updated: 2026-03-10 19:32
VLAI
EPSS
VEX
Title
iccDEV has a SEGV in CIccCLUT::Interp3d()
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault from invalid/wild pointer read in CIccCLUT::Interp3d() causing a denial of service. This vulnerability is fixed in 2.3.1.5.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 19:24 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/InternationalColorConsortium/i… | x_refsource_CONFIRM |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| InternationalColorConsortium | iccDEV |
Affected:
< 2.3.1.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31794",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T19:24:25.280645Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T19:32:26.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iccDEV",
"vendor": "InternationalColorConsortium",
"versions": [
{
"status": "affected",
"version": "\u003c 2.3.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault from invalid/wild pointer read in CIccCLUT::Interp3d() causing a denial of service. This vulnerability is fixed in 2.3.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T18:02:54.648Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6jrq-wfqg-wv7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6jrq-wfqg-wv7w"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/issues/645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/645"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/pull/653",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/pull/653"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5"
}
],
"source": {
"advisory": "GHSA-6jrq-wfqg-wv7w",
"discovery": "UNKNOWN"
},
"title": "iccDEV has a SEGV in CIccCLUT::Interp3d()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-31794",
"datePublished": "2026-03-10T18:02:54.648Z",
"dateReserved": "2026-03-09T16:33:42.912Z",
"dateUpdated": "2026-03-10T19:32:26.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31793 (GCVE-0-2026-31793)
Vulnerability from cvelistv5 – Published: 2026-03-10 18:01 – Updated: 2026-03-10 19:32
VLAI
EPSS
VEX
Title
iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence()
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault due to invalid/wild pointer read in CIccCalculatorFunc::ApplySequence() causing denial of service. This vulnerability is fixed in 2.3.1.5.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 19:24 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/InternationalColorConsortium/i… | x_refsource_CONFIRM |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| InternationalColorConsortium | iccDEV |
Affected:
< 2.3.1.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31793",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T19:24:02.991006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T19:32:26.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iccDEV",
"vendor": "InternationalColorConsortium",
"versions": [
{
"status": "affected",
"version": "\u003c 2.3.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault due to invalid/wild pointer read in CIccCalculatorFunc::ApplySequence() causing denial of service. This vulnerability is fixed in 2.3.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T18:01:48.521Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vgr5-3xqx-vcqx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vgr5-3xqx-vcqx"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/issues/644",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/644"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/pull/652",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/pull/652"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5"
}
],
"source": {
"advisory": "GHSA-vgr5-3xqx-vcqx",
"discovery": "UNKNOWN"
},
"title": "iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-31793",
"datePublished": "2026-03-10T18:01:48.521Z",
"dateReserved": "2026-03-09T16:33:42.912Z",
"dateUpdated": "2026-03-10T19:32:26.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28407 (GCVE-0-2026-28407)
Vulnerability from cvelistv5 – Published: 2026-02-27 21:28 – Updated: 2026-03-02 22:01
VLAI
EPSS
VEX
Title
malcontent's nested archive extraction failure can drop content from scan inputs
Summary
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-02 22:01 UTC
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/chainguard-dev/malcontent/secu… | x_refsource_CONFIRM |
| https://github.com/chainguard-dev/malcontent/pull/1383 | x_refsource_MISC |
| https://github.com/chainguard-dev/malcontent/comm… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chainguard-dev | malcontent |
Affected:
< 1.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-02T22:01:36.247390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-02T22:01:48.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "malcontent",
"vendor": "chainguard-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 1.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T21:28:06.258Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-945p-3jhm-6rcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-945p-3jhm-6rcp"
},
{
"name": "https://github.com/chainguard-dev/malcontent/pull/1383",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chainguard-dev/malcontent/pull/1383"
},
{
"name": "https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9"
}
],
"source": {
"advisory": "GHSA-945p-3jhm-6rcp",
"discovery": "UNKNOWN"
},
"title": "malcontent\u0027s nested archive extraction failure can drop content from scan inputs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28407",
"datePublished": "2026-02-27T21:28:06.258Z",
"dateReserved": "2026-02-27T15:33:57.289Z",
"dateUpdated": "2026-03-02T22:01:48.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21895 (GCVE-0-2026-21895)
Vulnerability from cvelistv5 – Published: 2026-01-08 14:06 – Updated: 2026-01-08 15:55
VLAI
EPSS
VEX
Title
rsa crate has potential panic on a prime being equal to 1
Summary
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-08 14:52 UTC
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/RustCrypto/RSA/security/adviso… | x_refsource_CONFIRM |
| https://github.com/RustCrypto/RSA/commit/2926c91b… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RustCrypto | RSA |
Affected:
< 0.9.10
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-08T14:52:10.453165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T15:55:13.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "RSA",
"vendor": "RustCrypto",
"versions": [
{
"status": "affected",
"version": "\u003c 0.9.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T14:06:29.288Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26"
},
{
"name": "https://github.com/RustCrypto/RSA/commit/2926c91bef7cb14a7ccd42220a698cf4b1b692f7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/RustCrypto/RSA/commit/2926c91bef7cb14a7ccd42220a698cf4b1b692f7"
}
],
"source": {
"advisory": "GHSA-9c48-w39g-hm26",
"discovery": "UNKNOWN"
},
"title": "rsa crate has potential panic on a prime being equal to 1"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-21895",
"datePublished": "2026-01-08T14:06:29.288Z",
"dateReserved": "2026-01-05T17:24:36.929Z",
"dateUpdated": "2026-01-08T15:55:13.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21493 (GCVE-0-2026-21493)
Vulnerability from cvelistv5 – Published: 2026-01-06 14:11 – Updated: 2026-01-06 14:33
VLAI
EPSS
VEX
Title
iccDEV has Type Confusion during XML Curve Serialization
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-06 14:32 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/InternationalColorConsortium/i… | x_refsource_CONFIRM |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| InternationalColorConsortium | iccDEV |
Affected:
< 2.3.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21493",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-06T14:32:26.415966Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-06T14:33:17.289Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iccDEV",
"vendor": "InternationalColorConsortium",
"versions": [
{
"status": "affected",
"version": "\u003c 2.3.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-188",
"description": "CWE-188: Reliance on Data/Memory Layout",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-06T14:11:27.054Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p85g-f9q7-jmjx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p85g-f9q7-jmjx"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/issues/358",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/358"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/commit/7ff76d1471077172f9659de8d9536443eac7c48f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/commit/7ff76d1471077172f9659de8d9536443eac7c48f"
}
],
"source": {
"advisory": "GHSA-p85g-f9q7-jmjx",
"discovery": "UNKNOWN"
},
"title": "iccDEV has Type Confusion during XML Curve Serialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-21493",
"datePublished": "2026-01-06T14:11:27.054Z",
"dateReserved": "2025-12-29T14:34:16.006Z",
"dateUpdated": "2026-01-06T14:33:17.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20329 (GCVE-0-2026-20329)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:02 – Updated: 2026-09-18 19:09
VLAI
EPSS
VEX
Title
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20329 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 00:00 UTC
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
Affected:
9.16.1
Affected: 9.16.1.28 Affected: 9.16.2 Affected: 9.16.2.3 Affected: 9.16.2.7 Affected: 9.16.2.11 Affected: 9.16.2.13 Affected: 9.16.2.14 Affected: 9.16.3.3 Affected: 9.16.3 Affected: 9.16.3.14 Affected: 9.16.3.15 Affected: 9.18.1.3 Affected: 9.18.2 Affected: 9.16.3.19 Affected: 9.16.3.23 Affected: 9.18.2.5 Affected: 9.16.4 Affected: 9.18.2.7 Affected: 9.16.4.9 Affected: 9.18.2.8 Affected: 9.16.4.14 Affected: 9.18.3 Affected: 9.16.4.18 Affected: 9.18.3.39 Affected: 9.16.4.19 Affected: 9.18.3.46 Affected: 9.16.4.27 Affected: 9.18.3.53 Affected: 9.18.3.55 Affected: 9.16.4.38 Affected: 9.16.4.39 Affected: 9.18.3.56 Affected: 9.20.1 Affected: 9.16.4.42 Affected: 9.18.4 Affected: 9.20.1.5 Affected: 9.18.4.5 Affected: 9.16.4.48 Affected: 9.18.4.8 Affected: 9.20.2 Affected: 9.16.4.55 Affected: 9.18.4.22 Affected: 9.20.2.10 Affected: 9.16.4.57 Affected: 9.18.4.24 Affected: 9.20.2.21 Affected: 9.16.4.61 Affected: 9.18.4.29 Affected: 9.20.2.22 Affected: 9.16.4.62 Affected: 9.18.4.34 Affected: 9.20.3 Affected: 9.16.4.67 Affected: 9.16.4.70 Affected: 9.18.4.40 Affected: 9.23.1 Affected: 9.22.1.1 Affected: 9.16.4.71 Affected: 9.20.3.4 Affected: 9.18.4.47 Affected: 9.20.3.7 Affected: 9.16.4.76 Affected: 9.20.3.9 Affected: 9.18.4.50 Affected: 9.22.1.3 Affected: 9.20.3.10 Affected: 9.22.1.2 Affected: 9.18.4.52 Affected: 9.20.3.13 Affected: 9.22.1.6 Affected: 9.18.4.53 Affected: 9.16.4.82 Affected: 9.22.2 Affected: 9.20.3.16 Affected: 9.19.1.42 Affected: 9.18.4.57 Affected: 9.16.4.84 Affected: 9.23.1.3 Affected: 9.20.3.20 Affected: 9.22.2.4 Affected: 9.23.1.7 Affected: 9.20.4 Affected: 9.22.2.9 Affected: 9.23.1.13 Affected: 9.20.4.7 Affected: 9.22.2.13 Affected: 9.18.4.66 Affected: 9.20.4.10 Affected: 9.23.1.19 Affected: 9.16.4.85 Affected: 9.22.2.14 Affected: 9.18.4.67 Affected: 9.24.1 Affected: 9.18.4.68 Affected: 9.23.1.22 Affected: 9.20.4.14 Affected: 9.22.2.20 Affected: 9.18.4.71 Affected: 9.20.4.19 Affected: 9.23.1.26 Affected: 9.16.4.89 Affected: 9.22.2.32 Affected: 9.18.4.76 Affected: 9.22.3 Affected: 9.24.1.5 Affected: 9.20.4.22 Affected: 9.24.1.9 Affected: 9.20.4.28 Affected: 9.22.3.5 Affected: 9.16.4.92 Affected: 9.18.4.135 Affected: 9.23.1.195 Affected: 9.20.4.30 Affected: 9.24.1.155 Affected: 9.23.1.32 Affected: 9.24.1.11 Affected: 9.20.4.34 Affected: 9.18.4.82 Affected: 9.24.10 Affected: 9.20.4.235 |
|
| Cisco | Cisco Secure Firewall Management Center (FMC) |
Affected:
7.0.0
Affected: 7.0.0.1 Affected: 7.0.1 Affected: 7.0.1.1 Affected: 7.0.2 Affected: 7.2.0 Affected: 7.0.2.1 Affected: 7.0.3 Affected: 7.2.0.1 Affected: 7.0.4 Affected: 7.2.1 Affected: 7.0.5 Affected: 7.3.0 Affected: 7.2.2 Affected: 7.3.1 Affected: 7.2.3 Affected: 7.2.3.1 Affected: 7.2.4 Affected: 7.0.6 Affected: 7.2.4.1 Affected: 7.2.5 Affected: 7.3.1.1 Affected: 7.4.0 Affected: 7.0.6.1 Affected: 7.2.5.1 Affected: 7.4.1 Affected: 7.2.6 Affected: 7.4.1.1 Affected: 7.0.6.2 Affected: 7.2.7 Affected: 7.2.5.2 Affected: 7.3.1.2 Affected: 7.2.8 Affected: 7.6.0 Affected: 7.4.2 Affected: 7.2.8.1 Affected: 7.0.6.3 Affected: 7.4.2.1 Affected: 7.2.9 Affected: 7.0.7 Affected: 7.7.0 Affected: 7.4.2.2 Affected: 7.2.10 Affected: 7.6.1 Affected: 7.4.2.3 Affected: 7.0.8 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.2.10.1 Affected: 7.0.8.1 Affected: 7.6.2.1 Affected: 7.2.10.2 Affected: 7.7.10.1 Affected: 7.4.2.4 Affected: 7.4.3 Affected: 7.6.3 Affected: 7.7.11 Affected: 7.6.4 Affected: 10.0.0 Affected: 7.4.4 Affected: 7.4.5 Affected: 7.0.9 Affected: 7.2.11 Affected: 7.7.12 Affected: 7.6.5 Affected: 7.4.6 Affected: 10.0.1 Affected: 7.4.7 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
7.0.0.1
Affected: 7.0.1 Affected: 7.0.1.1 Affected: 7.0.2 Affected: 7.0.2.1 Affected: 7.0.3 Affected: 7.0.4 Affected: 7.0.5 Affected: 7.3.0 Affected: 7.3.1 Affected: 7.0.6 Affected: 7.3.1.1 Affected: 7.4.0 Affected: 7.0.6.1 Affected: 7.4.1 Affected: 7.0.6.2 Affected: 7.4.1.1 Affected: 7.3.1.2 Affected: 7.6.0 Affected: 7.4.2 Affected: 7.0.6.3 Affected: 7.4.2.1 Affected: 7.0.7 Affected: 7.7.0 Affected: 7.4.2.2 Affected: 7.6.1 Affected: 7.4.2.3 Affected: 7.0.8 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.7.11 Affected: 7.0.8.1 Affected: 7.6.2.1 Affected: 7.7.10.1 Affected: 7.4.2.4 Affected: 7.4.3 Affected: 7.6.4 Affected: 10.0.0 Affected: 7.4.4 Affected: 7.0.9 Affected: 7.4.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T03:55:43.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.16.1"
},
{
"status": "affected",
"version": "9.16.1.28"
},
{
"status": "affected",
"version": "9.16.2"
},
{
"status": "affected",
"version": "9.16.2.3"
},
{
"status": "affected",
"version": "9.16.2.7"
},
{
"status": "affected",
"version": "9.16.2.11"
},
{
"status": "affected",
"version": "9.16.2.13"
},
{
"status": "affected",
"version": "9.16.2.14"
},
{
"status": "affected",
"version": "9.16.3.3"
},
{
"status": "affected",
"version": "9.16.3"
},
{
"status": "affected",
"version": "9.16.3.14"
},
{
"status": "affected",
"version": "9.16.3.15"
},
{
"status": "affected",
"version": "9.18.1.3"
},
{
"status": "affected",
"version": "9.18.2"
},
{
"status": "affected",
"version": "9.16.3.19"
},
{
"status": "affected",
"version": "9.16.3.23"
},
{
"status": "affected",
"version": "9.18.2.5"
},
{
"status": "affected",
"version": "9.16.4"
},
{
"status": "affected",
"version": "9.18.2.7"
},
{
"status": "affected",
"version": "9.16.4.9"
},
{
"status": "affected",
"version": "9.18.2.8"
},
{
"status": "affected",
"version": "9.16.4.14"
},
{
"status": "affected",
"version": "9.18.3"
},
{
"status": "affected",
"version": "9.16.4.18"
},
{
"status": "affected",
"version": "9.18.3.39"
},
{
"status": "affected",
"version": "9.16.4.19"
},
{
"status": "affected",
"version": "9.18.3.46"
},
{
"status": "affected",
"version": "9.16.4.27"
},
{
"status": "affected",
"version": "9.18.3.53"
},
{
"status": "affected",
"version": "9.18.3.55"
},
{
"status": "affected",
"version": "9.16.4.38"
},
{
"status": "affected",
"version": "9.16.4.39"
},
{
"status": "affected",
"version": "9.18.3.56"
},
{
"status": "affected",
"version": "9.20.1"
},
{
"status": "affected",
"version": "9.16.4.42"
},
{
"status": "affected",
"version": "9.18.4"
},
{
"status": "affected",
"version": "9.20.1.5"
},
{
"status": "affected",
"version": "9.18.4.5"
},
{
"status": "affected",
"version": "9.16.4.48"
},
{
"status": "affected",
"version": "9.18.4.8"
},
{
"status": "affected",
"version": "9.20.2"
},
{
"status": "affected",
"version": "9.16.4.55"
},
{
"status": "affected",
"version": "9.18.4.22"
},
{
"status": "affected",
"version": "9.20.2.10"
},
{
"status": "affected",
"version": "9.16.4.57"
},
{
"status": "affected",
"version": "9.18.4.24"
},
{
"status": "affected",
"version": "9.20.2.21"
},
{
"status": "affected",
"version": "9.16.4.61"
},
{
"status": "affected",
"version": "9.18.4.29"
},
{
"status": "affected",
"version": "9.20.2.22"
},
{
"status": "affected",
"version": "9.16.4.62"
},
{
"status": "affected",
"version": "9.18.4.34"
},
{
"status": "affected",
"version": "9.20.3"
},
{
"status": "affected",
"version": "9.16.4.67"
},
{
"status": "affected",
"version": "9.16.4.70"
},
{
"status": "affected",
"version": "9.18.4.40"
},
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.16.4.71"
},
{
"status": "affected",
"version": "9.20.3.4"
},
{
"status": "affected",
"version": "9.18.4.47"
},
{
"status": "affected",
"version": "9.20.3.7"
},
{
"status": "affected",
"version": "9.16.4.76"
},
{
"status": "affected",
"version": "9.20.3.9"
},
{
"status": "affected",
"version": "9.18.4.50"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.20.3.10"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.18.4.52"
},
{
"status": "affected",
"version": "9.20.3.13"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.18.4.53"
},
{
"status": "affected",
"version": "9.16.4.82"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.20.3.16"
},
{
"status": "affected",
"version": "9.19.1.42"
},
{
"status": "affected",
"version": "9.18.4.57"
},
{
"status": "affected",
"version": "9.16.4.84"
},
{
"status": "affected",
"version": "9.23.1.3"
},
{
"status": "affected",
"version": "9.20.3.20"
},
{
"status": "affected",
"version": "9.22.2.4"
},
{
"status": "affected",
"version": "9.23.1.7"
},
{
"status": "affected",
"version": "9.20.4"
},
{
"status": "affected",
"version": "9.22.2.9"
},
{
"status": "affected",
"version": "9.23.1.13"
},
{
"status": "affected",
"version": "9.20.4.7"
},
{
"status": "affected",
"version": "9.22.2.13"
},
{
"status": "affected",
"version": "9.18.4.66"
},
{
"status": "affected",
"version": "9.20.4.10"
},
{
"status": "affected",
"version": "9.23.1.19"
},
{
"status": "affected",
"version": "9.16.4.85"
},
{
"status": "affected",
"version": "9.22.2.14"
},
{
"status": "affected",
"version": "9.18.4.67"
},
{
"status": "affected",
"version": "9.24.1"
},
{
"status": "affected",
"version": "9.18.4.68"
},
{
"status": "affected",
"version": "9.23.1.22"
},
{
"status": "affected",
"version": "9.20.4.14"
},
{
"status": "affected",
"version": "9.22.2.20"
},
{
"status": "affected",
"version": "9.18.4.71"
},
{
"status": "affected",
"version": "9.20.4.19"
},
{
"status": "affected",
"version": "9.23.1.26"
},
{
"status": "affected",
"version": "9.16.4.89"
},
{
"status": "affected",
"version": "9.22.2.32"
},
{
"status": "affected",
"version": "9.18.4.76"
},
{
"status": "affected",
"version": "9.22.3"
},
{
"status": "affected",
"version": "9.24.1.5"
},
{
"status": "affected",
"version": "9.20.4.22"
},
{
"status": "affected",
"version": "9.24.1.9"
},
{
"status": "affected",
"version": "9.20.4.28"
},
{
"status": "affected",
"version": "9.22.3.5"
},
{
"status": "affected",
"version": "9.16.4.92"
},
{
"status": "affected",
"version": "9.18.4.135"
},
{
"status": "affected",
"version": "9.23.1.195"
},
{
"status": "affected",
"version": "9.20.4.30"
},
{
"status": "affected",
"version": "9.24.1.155"
},
{
"status": "affected",
"version": "9.23.1.32"
},
{
"status": "affected",
"version": "9.24.1.11"
},
{
"status": "affected",
"version": "9.20.4.34"
},
{
"status": "affected",
"version": "9.18.4.82"
},
{
"status": "affected",
"version": "9.24.10"
},
{
"status": "affected",
"version": "9.20.4.235"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Management Center (FMC)",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.2.3.1"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.2.10.1"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.2.10.2"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.6.3"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.6.4"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.5"
},
{
"status": "affected",
"version": "7.0.9"
},
{
"status": "affected",
"version": "7.2.11"
},
{
"status": "affected",
"version": "7.7.12"
},
{
"status": "affected",
"version": "7.6.5"
},
{
"status": "affected",
"version": "7.4.6"
},
{
"status": "affected",
"version": "10.0.1"
},
{
"status": "affected",
"version": "7.4.7"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.6.4"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.0.9"
},
{
"status": "affected",
"version": "7.4.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-20329 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703."
}
],
"exploits": [
{
"lang": "en",
"value": "Except as otherwise noted previously, the Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:09:48.774Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-hardening-asaftdfmc-uvpPROhN",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN"
}
],
"source": {
"advisory": "cisco-sa-hardening-asaftdfmc-uvpPROhN",
"defects": [
"CSCwu43348"
],
"discovery": "INTERNAL"
},
"title": "Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20329",
"datePublished": "2026-09-16T20:02:47.071Z",
"dateReserved": "2025-10-08T11:59:15.412Z",
"dateUpdated": "2026-09-18T19:09:48.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20280 (GCVE-0-2026-20280)
Vulnerability from cvelistv5 – Published: 2026-09-02 16:14 – Updated: 2026-09-18 12:10
VLAI
EPSS
VEX
CVE Program bundle warning
The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's "one vulnerability, one ID" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program's blog, "Preserving Vulnerability-Level Identification" linked below. Details within the CNA container below are viewable by clicking on the CNA name.
https://www.cve.org/Media/News/item/blog/2026/06/…Title
Cisco IOS XR Software Security Hardening Release: September 2026
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20280 are related to improper checking or handling of exceptional condition issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 00:00 UTC
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IOS XR Software |
Affected:
6.5.29
Affected: 7.0.1 Affected: 6.5.26 Affected: 6.5.25 Affected: 6.5.28 Affected: 6.5.90 Affected: 7.1.1 Affected: 7.0.90 Affected: 6.7.1 Affected: 7.0.2 Affected: 7.1.15 Affected: 7.2.1 Affected: 7.1.2 Affected: 6.7.2 Affected: 7.0.11 Affected: 7.0.12 Affected: 7.0.14 Affected: 7.1.25 Affected: 7.2.12 Affected: 7.3.1 Affected: 7.1.3 Affected: 6.7.3 Affected: 7.4.1 Affected: 7.2.2 Affected: 6.7.4 Affected: 6.5.31 Affected: 7.3.15 Affected: 7.3.16 Affected: 6.8.1 Affected: 7.4.15 Affected: 6.5.32 Affected: 7.3.2 Affected: 7.5.1 Affected: 7.4.16 Affected: 7.3.27 Affected: 7.6.1 Affected: 7.5.2 Affected: 7.8.1 Affected: 7.6.15 Affected: 7.5.12 Affected: 7.8.12 Affected: 7.3.3 Affected: 7.7.1 Affected: 6.8.2 Affected: 7.3.4 Affected: 7.4.2 Affected: 6.7.35 Affected: 6.9.1 Affected: 7.6.2 Affected: 7.5.3 Affected: 7.7.2 Affected: 6.9.2 Affected: 7.9.1 Affected: 7.10.1 Affected: 7.8.2 Affected: 7.5.4 Affected: 6.5.33 Affected: 7.8.22 Affected: 7.7.21 Affected: 7.9.2 Affected: 7.3.5 Affected: 7.5.5 Affected: 7.11.1 Affected: 7.9.21 Affected: 7.10.2 Affected: 24.1.1 Affected: 7.6.3 Affected: 7.3.6 Affected: 7.5.52 Affected: 7.11.2 Affected: 24.2.1 Affected: 24.1.2 Affected: 24.2.11 Affected: 24.3.1 Affected: 24.4.1 Affected: 24.2.2 Affected: 7.8.23 Affected: 7.11.21 Affected: 24.2.20 Affected: 24.3.2 Affected: 24.4.10 Affected: 6.5.35 Affected: 25.1.1 Affected: 24.4.2 Affected: 24.3.20 Affected: 24.4.15 Affected: 25.2.1 Affected: 6.5.351 Affected: 25.1.2 Affected: 24.3.30 Affected: 25.3.1 Affected: 6.5.352 Affected: 24.4.30 Affected: 24.2.21 Affected: 25.4.1 Affected: 25.2.2 Affected: 25.2.15 Affected: 7.2.0 Affected: 7.0.0 Affected: 25.2.30 Affected: 6.5.353 Affected: 26.1.1 Affected: 25.1.30 Affected: 25.3.15 Affected: 26.2.100 Affected: 25.4.2 Affected: 26.2.1 Affected: 25.4.30 Affected: 26.1.2 Affected: 25.4.201 Affected: 26.2.101 Affected: 25.2.21 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20280",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T03:56:28.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"descriptions": [
{
"lang": "en",
"value": "The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE\u0027s \"one vulnerability, one ID\" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program\u0027s blog, \"Preserving Vulnerability-Level Identification\" linked below. Details within the CNA container below are viewable by clicking on the CNA name."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:03:58.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"
}
],
"tags": [
"x_bundling-flagged-by-CVE-Program"
]
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco IOS XR Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "6.5.29"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "6.5.26"
},
{
"status": "affected",
"version": "6.5.25"
},
{
"status": "affected",
"version": "6.5.28"
},
{
"status": "affected",
"version": "6.5.90"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.0.90"
},
{
"status": "affected",
"version": "6.7.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.1.15"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "6.7.2"
},
{
"status": "affected",
"version": "7.0.11"
},
{
"status": "affected",
"version": "7.0.12"
},
{
"status": "affected",
"version": "7.0.14"
},
{
"status": "affected",
"version": "7.1.25"
},
{
"status": "affected",
"version": "7.2.12"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.1.3"
},
{
"status": "affected",
"version": "6.7.3"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "6.7.4"
},
{
"status": "affected",
"version": "6.5.31"
},
{
"status": "affected",
"version": "7.3.15"
},
{
"status": "affected",
"version": "7.3.16"
},
{
"status": "affected",
"version": "6.8.1"
},
{
"status": "affected",
"version": "7.4.15"
},
{
"status": "affected",
"version": "6.5.32"
},
{
"status": "affected",
"version": "7.3.2"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.4.16"
},
{
"status": "affected",
"version": "7.3.27"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.8.1"
},
{
"status": "affected",
"version": "7.6.15"
},
{
"status": "affected",
"version": "7.5.12"
},
{
"status": "affected",
"version": "7.8.12"
},
{
"status": "affected",
"version": "7.3.3"
},
{
"status": "affected",
"version": "7.7.1"
},
{
"status": "affected",
"version": "6.8.2"
},
{
"status": "affected",
"version": "7.3.4"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "6.7.35"
},
{
"status": "affected",
"version": "6.9.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.7.2"
},
{
"status": "affected",
"version": "6.9.2"
},
{
"status": "affected",
"version": "7.9.1"
},
{
"status": "affected",
"version": "7.10.1"
},
{
"status": "affected",
"version": "7.8.2"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "6.5.33"
},
{
"status": "affected",
"version": "7.8.22"
},
{
"status": "affected",
"version": "7.7.21"
},
{
"status": "affected",
"version": "7.9.2"
},
{
"status": "affected",
"version": "7.3.5"
},
{
"status": "affected",
"version": "7.5.5"
},
{
"status": "affected",
"version": "7.11.1"
},
{
"status": "affected",
"version": "7.9.21"
},
{
"status": "affected",
"version": "7.10.2"
},
{
"status": "affected",
"version": "24.1.1"
},
{
"status": "affected",
"version": "7.6.3"
},
{
"status": "affected",
"version": "7.3.6"
},
{
"status": "affected",
"version": "7.5.52"
},
{
"status": "affected",
"version": "7.11.2"
},
{
"status": "affected",
"version": "24.2.1"
},
{
"status": "affected",
"version": "24.1.2"
},
{
"status": "affected",
"version": "24.2.11"
},
{
"status": "affected",
"version": "24.3.1"
},
{
"status": "affected",
"version": "24.4.1"
},
{
"status": "affected",
"version": "24.2.2"
},
{
"status": "affected",
"version": "7.8.23"
},
{
"status": "affected",
"version": "7.11.21"
},
{
"status": "affected",
"version": "24.2.20"
},
{
"status": "affected",
"version": "24.3.2"
},
{
"status": "affected",
"version": "24.4.10"
},
{
"status": "affected",
"version": "6.5.35"
},
{
"status": "affected",
"version": "25.1.1"
},
{
"status": "affected",
"version": "24.4.2"
},
{
"status": "affected",
"version": "24.3.20"
},
{
"status": "affected",
"version": "24.4.15"
},
{
"status": "affected",
"version": "25.2.1"
},
{
"status": "affected",
"version": "6.5.351"
},
{
"status": "affected",
"version": "25.1.2"
},
{
"status": "affected",
"version": "24.3.30"
},
{
"status": "affected",
"version": "25.3.1"
},
{
"status": "affected",
"version": "6.5.352"
},
{
"status": "affected",
"version": "24.4.30"
},
{
"status": "affected",
"version": "24.2.21"
},
{
"status": "affected",
"version": "25.4.1"
},
{
"status": "affected",
"version": "25.2.2"
},
{
"status": "affected",
"version": "25.2.15"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "25.2.30"
},
{
"status": "affected",
"version": "6.5.353"
},
{
"status": "affected",
"version": "26.1.1"
},
{
"status": "affected",
"version": "25.1.30"
},
{
"status": "affected",
"version": "25.3.15"
},
{
"status": "affected",
"version": "26.2.100"
},
{
"status": "affected",
"version": "25.4.2"
},
{
"status": "affected",
"version": "26.2.1"
},
{
"status": "affected",
"version": "25.4.30"
},
{
"status": "affected",
"version": "26.1.2"
},
{
"status": "affected",
"version": "25.4.201"
},
{
"status": "affected",
"version": "26.2.101"
},
{
"status": "affected",
"version": "25.2.21"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the\u0026nbsp;Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20280 are related to improper checking or handling of exceptional condition issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T12:10:36.299Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-hardening-iosxr-qg64NcM",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM"
}
],
"source": {
"advisory": "cisco-sa-hardening-iosxr-qg64NcM",
"defects": [
"CSCwt41683"
],
"discovery": "INTERNAL"
},
"title": "Cisco IOS XR Software Security Hardening Release: September 2026"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20280",
"datePublished": "2026-09-02T16:14:19.941Z",
"dateReserved": "2025-10-08T11:59:15.403Z",
"dateUpdated": "2026-09-18T12:10:36.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20187 (GCVE-0-2026-20187)
Vulnerability from cvelistv5 – Published: 2026-07-15 16:18 – Updated: 2026-08-14 21:00
VLAI
EPSS
VEX
CVE Program bundle warning
The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's "one vulnerability, one ID" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program's blog, "Preserving Vulnerability-Level Identification" linked below. Details within the CNA container below are viewable by clicking on the CNA name.
https://www.cve.org/Media/News/item/blog/2026/06/…Title
Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20187 are related to improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 18:04 UTC
CWE
- CWE-703 - Improper Check or Handling of Exceptional Conditions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco RoomOS Software |
Affected:
RoomOS 10.11.2.2
Affected: RoomOS 10.15.2.2 Affected: RoomOS 11.5.4.6 Affected: RoomOS 11.5.2.4 Affected: RoomOS 10.8.2.5 Affected: RoomOS 10.11.5.2 Affected: RoomOS 10.11.3.0 Affected: RoomOS 10.15.5.3 Affected: RoomOS 10.19.2.2 Affected: RoomOS 11.1.3.1 Affected: RoomOS 10.11.6.0 Affected: RoomOS 10.19.3.0 Affected: RoomOS 10.19.4.2 Affected: RoomOS 10.3.2.4 Affected: RoomOS 10.3.4.0 Affected: RoomOS 10.15.3.0 Affected: RoomOS 11.1.4.1 Affected: RoomOS 11.14.2.3 Affected: RoomOS 11.1.2.4 Affected: RoomOS 10.8.3.1 Affected: RoomOS 11.14.2.1 Affected: RoomOS 10.3.3.0 Affected: RoomOS 10.8.4.0 Affected: RoomOS 10.15.4.1 Affected: RoomOS 10.19.5.6 Affected: RoomOS 10.11.4.1 Affected: RoomOS 11.9.3.1 Affected: RoomOS 11.5.3.3 Affected: RoomOS 10.3.2.0 Affected: RoomOS 11.9.2.4 Affected: RoomOS 11.14.3.0 Affected: RoomOS 11.17.2.2 Affected: RoomOS 11.14.4.0 Affected: RoomOS 10.19 StepUpg Affected: RoomOS 11.17.3.0 Affected: RoomOS 11.20.2.3 Affected: RoomOS 11.14.5.0 Affected: RoomOS 11.17.4.0 Affected: RoomOS 11.20.3.0 Affected: RoomOS 11.23.1.6 Affected: RoomOS 11.23.1.8 Affected: RoomOS 11.24.1.5 Affected: RoomOS 11.24.2.4 Affected: RoomOS 11.24.3.0 Affected: RoomOS 11.24.4.1 Affected: RoomOS 11.27.2.0 Affected: RoomOS 11.28.1.3 Affected: RoomOS 11.27.3.0 Affected: RoomOS 11.31.1.5 Affected: RoomOS 11.27.4.0 Affected: RoomOS 11.32.2.1 Affected: RoomOS 11.33.1.7 Affected: RoomOS 26.0.1.2 Affected: RoomOS 11.34.1.2 Affected: RoomOS 11.32.3.0 Affected: RoomOS 11.27.5.0 Affected: RoomOS 11.32.4.0 Affected: RoomOS 26.1.1.5 Affected: RoomOS 11.35.1.2 Affected: RoomOS 26.2.2.2 Affected: RoomOS 11.32.5.1 Affected: RoomOS 26.4.1.6 Affected: RoomOS 26.4.1.4 Affected: RoomOS 26.3.1.3 Affected: RoomOS 11.36.1.1 Affected: RoomOS 11.37.1.0 Affected: RoomOS 26.5.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20187",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T18:04:49.118521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T18:05:01.949Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"descriptions": [
{
"lang": "en",
"value": "The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE\u0027s \"one vulnerability, one ID\" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program\u0027s blog, \"Preserving Vulnerability-Level Identification\" linked below. Details within the CNA container below are viewable by clicking on the CNA name."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T21:00:52.536Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"
}
],
"tags": [
"x_bundling-flagged-by-CVE-Program"
]
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco RoomOS Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "RoomOS 10.11.2.2"
},
{
"status": "affected",
"version": "RoomOS 10.15.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.5.4.6"
},
{
"status": "affected",
"version": "RoomOS 11.5.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.2.5"
},
{
"status": "affected",
"version": "RoomOS 10.11.5.2"
},
{
"status": "affected",
"version": "RoomOS 10.11.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.5.3"
},
{
"status": "affected",
"version": "RoomOS 10.19.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.1.3.1"
},
{
"status": "affected",
"version": "RoomOS 10.11.6.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.4.2"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.3.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.1.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.1.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.1"
},
{
"status": "affected",
"version": "RoomOS 10.3.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.8.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.4.1"
},
{
"status": "affected",
"version": "RoomOS 10.19.5.6"
},
{
"status": "affected",
"version": "RoomOS 10.11.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.9.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.5.3.3"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.9.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.14.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.14.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.19 StepUpg"
},
{
"status": "affected",
"version": "RoomOS 11.17.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.14.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.6"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.8"
},
{
"status": "affected",
"version": "RoomOS 11.24.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.24.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.24.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.24.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.27.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.28.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.27.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.31.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.27.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.2.1"
},
{
"status": "affected",
"version": "RoomOS 11.33.1.7"
},
{
"status": "affected",
"version": "RoomOS 26.0.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.34.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.27.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.4.0"
},
{
"status": "affected",
"version": "RoomOS 26.1.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.35.1.2"
},
{
"status": "affected",
"version": "RoomOS 26.2.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.5.1"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.6"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.4"
},
{
"status": "affected",
"version": "RoomOS 26.3.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.36.1.1"
},
{
"status": "affected",
"version": "RoomOS 11.37.1.0"
},
{
"status": "affected",
"version": "RoomOS 26.5.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20187 are related to improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:18:37.525Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-hardening-roomos-AqNMbEq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq"
}
],
"source": {
"advisory": "cisco-sa-hardening-roomos-AqNMbEq",
"defects": [
"CSCwu64819"
],
"discovery": "INTERNAL"
},
"title": "Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20187",
"datePublished": "2026-07-15T16:18:37.525Z",
"dateReserved": "2025-10-08T11:59:15.394Z",
"dateUpdated": "2026-08-14T21:00:52.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18638 (GCVE-0-2026-18638)
Vulnerability from cvelistv5 – Published: 2026-08-11 15:00 – Updated: 2026-08-11 17:22
VLAI
EPSS
VEX
Title
Velociraptor server crash via the SetPassword API
Summary
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:15 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rapid7 | Velociraptor |
Affected:
0 , < 0.77.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:15:11.914584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:22:44.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Velociraptor",
"repo": "https://github.com/Velocidex/velociraptor/",
"vendor": "Rapid7",
"versions": [
{
"lessThan": "0.77.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The user must have at least reader permissions to the org before they can call the SetPassword API."
}
],
"value": "The user must have at least reader permissions to the org before they can call the SetPassword API."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mayank Rajput (https://github.com/hackelite01)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Any authenticated Velociraptor user \u2014 including one holding only the\u0026nbsp;\u003ccode\u003ereader\u003c/code\u003erole \u2014 can terminate the entire server process with a single request, by calling\u0026nbsp;\u003ccode\u003eSetPassword\u003c/code\u003e\u0026nbsp;with a\u0026nbsp;\u003ccode\u003eusername\u003c/code\u003e\u0026nbsp;that does not exist."
}
],
"value": "Any authenticated Velociraptor user \u2014 including one holding only the\u00a0readerrole \u2014 can terminate the entire server process with a single request, by calling\u00a0SetPassword\u00a0with a\u00a0username\u00a0that does not exist."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL pointer dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-703",
"description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T15:00:53.332Z",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Velociraptor server crash via the SetPassword API",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2026-18638",
"datePublished": "2026-08-11T15:00:53.332Z",
"dateReserved": "2026-08-03T10:45:04.075Z",
"dateUpdated": "2026-08-11T17:22:44.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.