Vendor and authority advisories

Search Search

Category

• All
• Threats, ransomware & breaches
• Vulnerabilities & exploits
• Network & security devices
• Cloud & SaaS
• Hardware & firmware
• Identity & access
• OT, ICS & IoT
• Applications & supply chain
• AI security
• Policy, regulation & law enforcement

Region

• All regions
• Global
• United States
• European Union

• Applications & supply chain CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability… CISA Cybersecurity Advisories · United States · 26 Oct 2026
• Applications & supply chain 2026-018: Critical Vulnerabilities in PHPOn 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution (RCE). The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP… CERT-EU Security Advisories · European Union · 23 Oct 2026
• Applications & supply chain CISA Adds One Known Exploited Vulnerability to CatalogCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses… CISA Cybersecurity Advisories · United States · 23 Oct 2026
• Applications & supply chain Open Source Snort 3 Control Channel Socket Arbitrary Command Execution VulnerabilityA vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the… Cisco Security Advisories · Global · 21 Oct 2026
• Applications & supply chain CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (Severity: LOW) Palo Alto Networks Security Advisories · Global · 15 Oct 2026
• Applications & supply chain SQL command injection in webmailCVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
• Applications & supply chain CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: LOW) Palo Alto Networks Security Advisories · Global · 9 Sep 2026
• Applications & supply chain Cross-Site Scripting in Domain parameterCVSSv3 Score: 5.9 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
• Applications & supply chain Missed certificate verification in AD Connector communication with FortiClient EMSCVSSv3 Score: 7.5 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
• Applications & supply chain Improper access control in API endpointsCVSSv3 Score: 6.5 An improper access control vulnerability [CWE-284] in FortiPortal API endpoints may allow a remote privileged attacker with organization user role to obtain sensitive network configuration data via crafted HTTP requests. Revised on 2026-06-09 00:00:00 Fortinet PSIRT · Global · 9 Jun 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.