Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 11:34 IST · 7 sources · Get these by email

Threats, ransomware & breaches Unauthenticated VNC access exposed on all interfacesCVSSv3 Score: 8.6 An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSandbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Applications & supply chain Cross-Site Scripting in Domain parameterCVSSv3 Score: 5.9 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Applications & supply chain Missed certificate verification in AD Connector communication with FortiClient EMSCVSSv3 Score: 7.5 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Threats, ransomware & breaches Out of bounds read in GUICVSSv3 Score: 7.5 An out of bounds read [CWE-125] vulnerability in FortiAuthenticator may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Network & security devices Path traversal in CLI command allows deletion of root file systemCVSSv3 Score: 5.5 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted… Fortinet PSIRT · Global · 14 Jul 2026
Network & security devices SSL-VPN Reflected XSSCVSSv3 Score: 6.1 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests.… Fortinet PSIRT · Global · 14 Jul 2026
Network & security devices Header injection in captive portal authentication formCVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted… Fortinet PSIRT · Global · 14 Jul 2026
Network & security devices Header injection in Web Filter warning pageCVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a… Fortinet PSIRT · Global · 14 Jul 2026
Network & security devices Buffer overread in authd and wad daemonCVSSv3 Score: 4.3 A buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request. Revised on 2026-07-14 00:00:00 Fortinet PSIRT · Global · 14 Jul 2026
Applications & supply chain Improper access control in API endpointsCVSSv3 Score: 6.5 An improper access control vulnerability [CWE-284] in FortiPortal API endpoints may allow a remote privileged attacker with organization user role to obtain sensitive network configuration data via crafted HTTP requests. Revised on 2026-06-09 00:00:00 Fortinet PSIRT · Global · 9 Jun 2026
Cloud & SaaS Second-Order OS Command Injection via JSON Input on start vnc featureCVSSv3 Score: 9.8 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Revised on… Fortinet PSIRT · Global · 9 Jun 2026
Network & security devices Restricted CLI escape using LuaCVSSv3 Score: 6.7 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands. Revised on 2026-06-09 00:00:00 Fortinet PSIRT · Global · 9 Jun 2026
Policy, regulation & law enforcement LDAP authentication bypass in Agentless VPN and FSSOCVSSv3 Score: 8.1 An Authentication Bypass by Primary Weakness vulnerability [CWE-305] in FortiOS fnbamd may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, under specific LDAP server configuration. Revised on 2026-07-04 00:00:00 Fortinet PSIRT · Global · 10 Feb 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.