CVE-2026-41999
Incorrect Behaviour of Views with TCP PROXY Requests
CVSS
4.8
Medio
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 21 may 2026 · Última mod.: 23 jul 2026 · CWE-284
0.1%EPSS · 30 días0.1%
2026-08-052026-09-02
Incorrect Behaviour of Views with TCP PROXY Requests
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-202799.8 CRÍ—
——0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.1dCVE-2026-846688.8 ALT—
——0Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.1dCVE-2026-846516.3 MED—
——0In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.1dCVE-2026-848045.4 MED—
——0Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.1dCVE-2026-737626.6 MED13.8%
——4A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.1dCVE-2026-737508.8 ALT40.7%
——12Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.1d