PULSE
EN
FEED
ransomqilin reclama a Select Community Management · US · Professional Servicesransomqilin reclama a CMD Naturkosmetik · DE · Retail & E-Commerceransomqilin reclama a qc-consult · DE · Professional Servicesransombarracuda reclama a EVINOKS · TR · Technologyransomqilin reclama a Danser · US · Otherransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NLransomqilin reclama a Select Community Management · US · Professional Servicesransomqilin reclama a CMD Naturkosmetik · DE · Retail & E-Commerceransomqilin reclama a qc-consult · DE · Professional Servicesransombarracuda reclama a EVINOKS · TR · Technologyransomqilin reclama a Danser · US · Otherransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NL
← Todos los CVEs
CVE Watch18 oct 2026

CVE-2025-20363

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defens

CVSS

9.0

Crítico

EPSS

6.9%

p94

KEV

—

Exploit Today

28

0-100

Publicado: 25 sept 2025 · Última mod.: 18 oct 2026 · CWE-122

EPSS · 30d
6.9%EPSS · 30 días6.9%
2026-10-032026-10-31
Descripción técnica

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1202087.5 ALT
—
——0libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.22hCVE-2026-102212—
—
——0Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.1dCVE-2026-1197276.5 MED
16.7%
——5A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.2dCVE-2026-1101335.8 MED
14.5%
——4A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.2dCVE-2026-95367.5 ALT
23.6%
——7A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.2dCVE-2026-961998.8 ALT
48.0%
——14Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.2d