Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 05:35 IST · 7 sources · Get these by email

Threats, ransomware & breaches Improper limitation of a pathname to a restricted directoryCVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP… Fortinet PSIRT · Global · 1 Oct 2026
Threats, ransomware & breaches Arbitrary process termination from exposed minifilter communication portCVSSv3 Score: 5.1 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Open Redirect on FortiSIEMCVSSv3 Score: 3.1 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches JWT used for authentication in web GUI signed with static keyCVSSv3 Score: 9.8 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Cron Job Injection in Remote BackupCVSSv3 Score: 6.7 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Broken Access control on Websocket streamsCVSSv3 Score: 5.4 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Server-Side Request Forgery (SSRF)CVSSv3 Score: 3.8 A Server-Side request forgery (SSRF) [CWE-918] vulnerability in FortiSIEM GUI may allow an authenticated attacker to send HTTP requests originating from the targeted device via specially crafted HTTP requests Revised on 2026-08-12 00:00:00 Fortinet PSIRT · Global · 12 Aug 2026
Threats, ransomware & breaches Content-Encoding WAF EvasionCVSSv3 Score: 5.3 An incomplete list of disallowed inputs [CWE-184] in FortiWeb WAF may allow an unauthenticated attacker to bypass policies via specifically crafted requests. Revised on 2026-08-12 00:00:00 Fortinet PSIRT · Global · 12 Aug 2026
Threats, ransomware & breaches Broken access control in the RADIUS type admin groupCVSSv3 Score: 9.8 An Improper Authentication vulnerability [CWE-287] in the FortiWeb Remote Radius Type Admin Authentication configured with specific, non-default settings may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password Revised on… Fortinet PSIRT · Global · 12 Aug 2026
Threats, ransomware & breaches Supers override fails to properly override supervisor addressCVSSv3 Score: 7.5 An Improper Restriction of Communication Channel to Intended Endpoints [CWE-923] vulnerability in FortiSIEM Windows Agent may allow an unauthorized attacker on the same local network to execute arbitrary code via spoofing the supervisors hostname when the Windows device is… Fortinet PSIRT · Global · 14 Jul 2026
Threats, ransomware & breaches Out of bounds read in GUICVSSv3 Score: 7.5 An out of bounds read [CWE-125] vulnerability in FortiAuthenticator may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Threats, ransomware & breaches Unauthenticated VNC access exposed on all interfacesCVSSv3 Score: 8.6 An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSandbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.