Section
Advisories
Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.
566 matching records, 3 with confirmed exploitation.
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability This…
-
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire…
-
Authentication bypass by primary weakness
CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on…
-
Incorrect authorization
CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiAuthenticator may allow an attacker to bypass authentication and gain unauthorized access. Revised on 2026-11-10 00:00:00
-
Authorization bypass through user-controlled key
CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.…
-
Authentication bypass
CVSSv3 Score: 9.0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and…
-
Incorrect authorization
CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted…
-
Improper neutralization of special elements used in an os command
CVSSv3 Score: 9.8 An Improper neutralization of special elements used in a command ('command injection') [CWE-77] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA…
-
Improper limitation of a pathname to a restricted directory
CVSSv3 Score: 9.8 An Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted…
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 9.4 An Improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.…
-
Unbound vulnerabilities
USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding update for…
-
FGFM elevation before registration password is verified
CVSSv3 Score: 9.0 An improper authorization vulnerability in FortiManager FGFM may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. Revised on 2026-11-10 00:00:00
-
Authorization bypass through user-controlled key in dmserver
CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via…
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 8.8 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')[CWE-89] in FortiAuthenticator may allow an authenticated attacker to execute unauthorized SQL commands on the underlying…
-
Improper neutralization of special elements used in an ldap query
CVSSv3 Score: 8.2 An Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')[CWE-90] in FortiAuthenticator may allow an authenticated attacker to bypass authentication. Successful exploitation…
-
Improper privilege management
CVSSv3 Score: 7.2 An Improper Privilege Management vulnerability[CWE-269] in FortiAuthenticator may allow an authenticated attacker to escalate privileges. Revised on 2026-11-10 00:00:00
-
Allocation of resources without limits or throttling in fastapi
CVSSv3 Score: 7.5 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiAuthenticator may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of…
-
Authorization bypass through user-controlled key
CVSSv3 Score: 8.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users'…
-
Improper neutralization of special elements in output used by a downstream component in sshd
CVSSv3 Score: 7.4 A Path Traversal vulnerability [cwe-24] in FortiOS, FortiSASE, FortiProxy and FortiPam ssh daemon may allow an unauthenticated attacker to bypass authentication via specially crafted credentials. Revised on…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder may allow an authenticated privileged attacker to execute…
-
Improper neutralization of special elements used in an OS command in webmail
CVSSv3 Score: 8.8 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder and FortiVoice may allow an authenticated attacker to execute…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) vulnerability [CWE-78] in FortiMail may allow an authenticated administrator with system-time read-write access to…
-
Improper neutralization of special elements used in a command
CVSSv3 Score: 7.6 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') [CWE-88] in FortiMail may allow an authenticated remote attacker with domain admin or admin privileges to delete users of…
-
Improper authentication in releasecontrol
CVSSv3 Score: 8.2 An Improper Authentication vulnerability [CWE-287] in FortiMail may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted…
-
Authorization bypass through user-controlled key
CVSSv3 Score: 7.5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted…
-
Improper neutralization of special elements used in an os command
CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail may allow an authenticated administrator to execute unauthorized code or commands…
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Windows Active Directory Certificate Services Security Feature Bypass
Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.
-
Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management…
-
Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management…
-
Apache HTTP Server vulnerabilities
Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to…
-
Improper neutralization of special elements used in an os command in GUI
CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [cwe-78] in FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, FortiSASE-Sovereign…
-
Improper limitation of a pathname to a restricted directory in apache_mod
CVSSv3 Score: 7.2 A Path Traversal vulnerability [CWE-22] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to write arbitrary files via a specially crafted…
-
Broken Access Control in Two-Factor-Authentication
CVSSv3 Score: 5.9 An Improper Authentication vulnerability [CWE-287] in the FortiOS Remote Radius Type Admin Two-Factor (TFA) Authentication may allow a remote authenticated attacker with at least read-only permission to log in…
-
Arbitrary file write and delete in JSON API
CVSSv3 Score: 7.3 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an…
-
Heap-based buffer overflow
CVSSv3 Score: 7.2 A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud may allow an authenticated attacker with admin privileges to execute unauthorized…
-
Improper neutralization of special elements used in a template engine in fortisoc
CVSSv3 Score: 7.2 A Use of Externally-Controlled Format String [CWE-134] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud API may allow an authenticated attacker to execute unauthorized commands via…
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 8.8 An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an…
-
Authorization bypass through user-controlled key
CVSSv3 Score: 8.2 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiManager may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP…
-
Improper neutralization of special elements used in an OS command
CVSSv3 Score: 7.2 An improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability (CWE-78) in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud system-ha plugin may…
-
Incorrect authorization
CVSSv3 Score: 8.7 An Incorrect Authorization vulnerability [CWE-863], an Improper Privilege Management vulnerability [CWE-269] and an Authentication Bypass by Spoofing vulnerability [CWE-290] in FortiManager, FortiManager Cloud…
-
Improper certificate validation in RADIUS protocol
CVSSv3 Score: 7.5 An Improper Certificate Validation vulnerability [CWE-295] in FortiSASE Sovereign, FortiManager, Fortianalyzer, FortiManager Cloud and FortiAnalyzer Cloud RADIUS protocol may allow a MITM attacker to impersonate…
-
Improper control of generation of code in GUI
CVSSv3 Score: 7.2 An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] and a Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability [CWE-120] in FortiManager…
-
Improper limitation of a pathname to a restricted directory
CVSSv3 Score: 7.2 An Improper Limitation of a Pathname to a Restricted Directory (CWE-22) vulnerability in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud may allow an authenticated attacker with admin…
-
Improper neutralization of special elements used in an os command
CVSSv3 Score: 7.2 An OS Command Injection vulnerability [CWE-78] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to execute unauthorized code or commands via…
-
Improper limitation of a pathname to a restricted directory
CVSSv3 Score: 7.2 An External Control of File Name or Path vulnerability [CWE-22] and an Improper Neutralization of Special Elements vulnerability [CWE-74] in FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer…
-
Improper neutralization of special elements used in a template engine
CVSSv3 Score: 7.2 A Server-Side Template Injection vulnerability [CWE-1336] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated attacker with restricted privileges to execute…
-
Improper neutralization of special elements used in a template engine i
CVSSv3 Score: 8.4 An Improper Neutralization of Special Elements Used in a Template Engine vulnerability [CWE-1336] in FortiManager and FortiManager Cloud may allow a low privileged Device Manager admin to obtain super admin…
-
Improper privilege management
CVSSv3 Score: 7.2 An improper privilege management vulnerability [CWE-269] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to elevate their privileges via…
-
Improper control of generation of code
CVSSv3 Score: 7.2 A Code Injection vulnerability [CWE-94] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to execute unauthorized code or commands via specially…
-
Improper neutralization of special elements used in an SQL command
CVSSv3 Score: 7.1 An SQL Injection vulnerability [CWE-89] in FortiManager, FortiManager Cloud, FortiAnalyzer, FortiAnalyzer Cloud may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted…
-
Authorization bypass through user-controlled key in GUI
CVSSv3 Score: 8.7 An Authorization Bypass Through User-Controlled Key vulnerability [cwe-639] in FortiManager, FortiManager Cloud and FortiSase-Sovereign GUI may allow an authenticated attacker to execute commands outside of the…
-
Heap-based buffer overflow
CVSSv3 Score: 7.2 A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to execute unauthorized code or commands…
-
Authentication bypass by spoofing
CVSSv3 Score: 8.2 An authentication bypass by spoofing vulnerability (CWE-290) in FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, FortiManager Cloud, FortiSASE-Sovereign fortilogd may allow an attacker to…
-
Improper neutralization of argument delimiters in a command
CVSSv3 Score: 7.2 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')[CWE-88] vulnerability in FortiManager,FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud may allow an authenticated…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability This type of…
-
Multiple Vulnerabilities in SonicWall SonicOS Could Allow for Authentication Bypass
Multiple vulnerabilities have been discovered in SonicWall SonicOS, the most severe of which could allow for Authentication Bypass. SonicOS is the operating system that powers SonicWall firewalls and network security appliances.…
-
Moderate: unbound security, bug fix, and enhancement update
An update for unbound is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Remote Desktop Client Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.
-
Windows Kerberos Denial of Service Vulnerability
Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.
-
Windows Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally.
-
Windows Active Directory Certificate Services Information Disclosure Vulnerability
Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.
-
Windows Hyper-V Denial of Service Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.
-
Windows Kerberos Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.
-
Windows Hyper-V Denial of Service Vulnerability
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
-
Moderate: unbound security, bug fix, and enhancement update
An update for unbound is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives…
-
CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
Bulletin ID: 2026-176-AWS Publication Date: 11/10/2026 08:30 AM PST Description: We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s…
-
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Azure CLI Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.
-
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Microsoft Office SharePoint Information Disclosure Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
-
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
HEVC Video Extensions Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
-
HEVC Video Extensions Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
-
HEVC Video Extensions Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
-
Azure Local Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.
-
Azure CycleCloud Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
-
Visual Studio Code Security Feature Bypass Vulnerability
Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
Microsoft 365 Agents SDK Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.
-
Microsoft PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
-
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
ASP.NET Core Elevation of Privilege Vulnerability
Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
Microsoft Office SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
Azure Firmware Security Feature Bypass Vulnerability
Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.
-
ASP.NET Core Information Disclosure Vulnerability
Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
-
Azure DevOps Server Remote Code Execution Vulnerability
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
-
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.
-
Microsoft Office SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Windows NTFS Tampering Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an authorized attacker to perform tampering locally.
-
Windows Shell Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
-
Windows NTFS Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate…
-
Windows DHCP Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
-
Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
Null pointer dereference in Microsoft Windows SCSI Class System File allows an authorized attacker to elevate privileges locally.
-
Linux kernel vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
Reuse this view
Same filters as JSON: /api/items?category=advisory&window=7d&limit=100. RSS for this section: feed.xml.