Section

Advisories

Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.

18 matching records, 1 with confirmed exploitation.

66

Advisory Fortinet PSIRT 6d ago

Node2Shell CVEs

CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

CVSS 9.8 EPSS 0.83 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069+7 more Fortinet Node.js Developer platform
65

CISA alert CISA 15d ago

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764…

Exploited EPSS 0.19 CVE-2025-61624 CVE-2026-102764 Fortinet BeyondTrust Remote access
64

Advisory Fortinet PSIRT 11d ago

PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory…

CVSS 9.8 EPSS 1.00 CVE-2026-109618 CVE-2026-109619 Fortinet PHP Web platform
37

Advisory Fortinet PSIRT 19d ago

Improper access control and session management in the web management interface

CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on…

CVSS 9.6 Fortinet Endpoint security
37

Advisory Fortinet PSIRT 19d ago

Arbitrary file write in grpc phQueryMaster

CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted…

CVSS 9.4 Fortinet Network management
36

Advisory Fortinet PSIRT 19d ago

SQL command injection in webmail

CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands…

CVSS 7.7 Fortinet Email
29

Advisory Fortinet PSIRT 19d ago

Multiple Arbitrary File Read/Write via SQL Injection

CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low…

CVSS 7.9 Fortinet Network management
29

Advisory Fortinet PSIRT 19d ago

GUI Denial of Service

CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP…

CVSS 6.7 Fortinet Edge / VPN / firewall
27

MS-ISAC advisory MS-ISAC 29d ago

A Vulnerability in Fortinet FortiMail Could Allow for Arbitrary Code Execution

A vulnerability has been discovered in Fortinet FortiMail that could allow for arbitrary code execution. Fortinet FortiMail is a secure email gateway that protects organizations from inbound threats including spam, phishing…

Cisco Fortinet Email
26

Advisory Fortinet PSIRT 19d ago

Double free in signal handler

CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00

CVSS 2.1 Fortinet Edge / VPN / firewall
22

CCCS advisory CCCS 8d ago

Fortinet security advisory (AV26-1037)

CVE-2026-106173 Fortinet
22

Advisory Fortinet PSIRT 19d ago

HTML injection in WebUI

CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field.…

CVSS 4.9 Fortinet Network management
22

Advisory Fortinet PSIRT 19d ago

Fabric API Authentication bypass

CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13…

CVSS 4.9 Fortinet Endpoint security
22

Advisory Fortinet PSIRT 19d ago

Persistent Denial of Service in Admin Profile

CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00

CVSS 4.8 Fortinet Endpoint security
22

Advisory Fortinet PSIRT 19d ago

arbitrary command execution in fgfmsd daemon

CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster…

CVSS 5.3 Fortinet Network management
19

Advisory Fortinet PSIRT 19d ago

Broken authorization

CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00

CVSS 3.4 Fortinet Network management
13

Outbreak alert FortiGuard 9d ago

PHP2Shell Remote Code Execution Vulnerabilities

Successful exploitation could allow attackers to execute arbitrary code within the PHP application process, potentially compromising the affected server and exposing sensitive data, application files, or connected databases…

Fortinet PHP Web platform
10

CCCS advisory CCCS 8d ago

Fortinet security advisory (AV26-1081)

Fortinet

Reuse this view

Same filters as JSON: /api/items?category=advisory&window=30d&vendor=Fortinet&limit=100. RSS for this section: feed.xml.