Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 01:28 IST · 7 sources · Get these by email

Cloud & SaaS CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities (Severity: MEDIUM) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Cloud & SaaS CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Cloud & SaaS Multiple Arbitrary File Read/Write via SQL InjectionCVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on… Fortinet PSIRT · Global · 13 Oct 2026
Cloud & SaaS Fabric API Authentication bypassCVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Cloud & SaaS Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive InformationCVSSv3 Score: 9.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Cloud & SaaS FGFM Authentication Weakening via CLI ConfigurationCVSSv3 Score: 8.1 An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests… Fortinet PSIRT · Global · 12 Aug 2026
Cloud & SaaS Second-Order OS Command Injection via JSON Input on start vnc featureCVSSv3 Score: 9.8 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Revised on… Fortinet PSIRT · Global · 9 Jun 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.