Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 05:35 IST · 7 sources · Get these by email

Vulnerabilities & exploits CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Vulnerabilities & exploits CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability (Severity: MEDIUM) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Vulnerabilities & exploits PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Cloud & SaaS CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (Severity: LOW) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Vulnerabilities & exploits CVE-2026-0315 GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Network & security devices Cisco Secure Email Gateway Arbitrary File Write VulnerabilityA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation… Cisco Security Advisories · Global · 14 Oct 2026
Cloud & SaaS CVE-2026-0312 Checkov by Prisma Cloud: Path Traversal Vulnerabilities (Severity: MEDIUM) Palo Alto Networks Security Advisories · Global · 14 Oct 2026
Network & security devices Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass VulnerabilityA vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access… Cisco Security Advisories · Global · 13 Oct 2026
Threats, ransomware & breaches Persistent Denial of Service in Admin ProfileCVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Applications & supply chain SQL command injection in webmailCVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches arbitrary command execution in fgfmsd daemonCVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted… Fortinet PSIRT · Global · 13 Oct 2026
Network & security devices GUI Denial of ServiceCVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Improper access control and session management in the web management interfaceCVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Cloud & SaaS Multiple Arbitrary File Read/Write via SQL InjectionCVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on… Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Arbitrary file write in grpc phQueryMasterCVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Broken authorizationCVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Network & security devices Double free in signal handlerCVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Cloud & SaaS Fabric API Authentication bypassCVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches 2026-016: Critical Vulnerability in GitLab CE and EEOn 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly… CERT-EU Security Advisories · European Union · 12 Oct 2026
Network & security devices Cisco NX-OS Software NX-API Remote Code Execution VulnerabilityA vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is… Cisco Security Advisories · Global · 8 Oct 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.