Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 05:35 IST · 7 sources · Get these by email

Threats, ransomware & breaches CVE-2026-118147 Visual Studio Spoofing VulnerabilityImproper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. Microsoft Security Response Center · Global · 30 Oct 2026
Threats, ransomware & breaches USN-8958-1: .NET vulnerabilitiesIt was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected… Ubuntu Security Notices · Global · 29 Oct 2026
Threats, ransomware & breaches USN-8956-2: Brotli vulnerabilityUSN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this… Ubuntu Security Notices · Global · 27 Oct 2026
Threats, ransomware & breaches USN-8956-1: Brotli vulnerabilityIt was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. Ubuntu Security Notices · Global · 26 Oct 2026
Threats, ransomware & breaches USN-8955-1: nginx vulnerabilitiesIt was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered… Ubuntu Security Notices · Global · 26 Oct 2026
Threats, ransomware & breaches USN-8954-1: zlib vulnerabilityAli Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution. Ubuntu Security Notices · Global · 22 Oct 2026
Threats, ransomware & breaches USN-8952-1: Tornado vulnerabilitiesIt was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,… Ubuntu Security Notices · Global · 22 Oct 2026
Threats, ransomware & breaches USN-8890-2: libsoup vulnerabilitiesUSN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of… Ubuntu Security Notices · Global · 21 Oct 2026
Threats, ransomware & breaches USN-8951-1: c-ares vulnerabilitiesIt was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares… Ubuntu Security Notices · Global · 21 Oct 2026
Threats, ransomware & breaches arbitrary command execution in fgfmsd daemonCVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted… Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Arbitrary file write in grpc phQueryMasterCVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Broken authorizationCVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Improper access control and session management in the web management interfaceCVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Persistent Denial of Service in Admin ProfileCVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Improper limitation of a pathname to a restricted directoryCVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP… Fortinet PSIRT · Global · 1 Oct 2026
Threats, ransomware & breaches Arbitrary process termination from exposed minifilter communication portCVSSv3 Score: 5.1 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Open Redirect on FortiSIEMCVSSv3 Score: 3.1 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches JWT used for authentication in web GUI signed with static keyCVSSv3 Score: 9.8 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Cron Job Injection in Remote BackupCVSSv3 Score: 6.7 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026
Threats, ransomware & breaches Broken Access control on Websocket streamsCVSSv3 Score: 5.4 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00 Fortinet PSIRT · Global · 8 Sep 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.