CVE-2026-20272

Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xe Ios Xe Software

CVE-2026-20271

Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20271 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-691. &nbsp;

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xe Ios Xe Software

CVE-2026-20270

Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20270 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xe Ios Xe Software

CVE-2026-20269

Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20269 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xe Ios Xe Software

CVE-2026-20268

Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20268 are related to issues with improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xe Ios Xe Software

CVE-2026-20187

Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20187 are related to improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-20158

Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20158 are related to improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Roomos Roomos Cloud Roomos Software

CVE-2026-20157

Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20157 are related to missing encryption that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-311.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-20156

Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20156 are related to improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-20153

Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20153 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-20150

Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20150 are related to improper access control&nbsp;that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Roomos Software Roomos Roomos Cloud

CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content

Cross-repository issue/comment attachment re-linking can expose private attachment content

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-56859

Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Encoding/xml

CVE-2026-56860

Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Net/url

CVE-2026-73847

Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Emlog

Products

Emlog

CVE-2026-73670

CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Saurus

Products

Saurus Cms

CVE-2026-73531

django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can exploit the lack of sanitization and Content-Disposition headers at the attachment-serving layer to execute malicious scripts in the browser session of authenticated staff members who open the attachment while triaging tickets.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Django-helpdesk Project

Products

Django-helpdesk

CVE-2026-73481

phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phplist

Products

Phplist

CVE-2026-73480

gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Dundee

Products

Gdu