CVE-2026-76447

Cisco Identity Services Engine Certificate Reload Vulnerability

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-57449

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Actualbudget

Products

Actual

CVE-2026-76444

Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-100419

gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gitoxide

CVE-2026-76439

Cisco Identity Services Engine Event Injection Vulnerability

A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-88003

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_type. When one administrator downgrades another account, the target's active session continues to authorize administrative requests. The downgraded user can use Users::form() to set user_type back to 1, restoring the database role and making the privilege escalation persistent. This vulnerability is fixed in 1.7.2.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Invoiceplane

Products

Invoiceplane

CVE-2026-76446

Cisco Identity Services Engine External Entity Injection Vulnerability

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific&nbsp;files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific&nbsp;files on the affected system that the underlying process has permission to access.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76449

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76450

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76451

Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76448

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-20234

Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20234 are related to insufficiently protected credentials issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-20130

Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-20192

Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76427

Cisco ISE XML External Entity Injection Vulnerability

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76426

Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software

CVE-2026-76425

Cisco ISE SQL Injection Vulnerability

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Software

CVE-2026-76424

Cisco ISE Arbitrary File Access Vulnerability

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device.&nbsp;To exploit this vulnerability, the attacker must have valid administrative credentials.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine Identity Services Engine Software

CVE-2026-101013

mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mathurvishal

Products

Cloudclassroom-php-project

CVE-2026-101010

aaPanel BaoTa data.py getData sql injection

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Aapanel

Products

Baota