CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to
CVSSv3 Score: 8.7 An Authorization Bypass Through User-Controlled Key vulnerability [cwe-639] in FortiManager, FortiManager Cloud and FortiSase-Sovereign GUI may allow an authenticated attacker
CVSSv3 Score: 7.5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arb
CVSSv3 Score: 8.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or
CVSSv3 Score: 9.0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outsid
CVSSv3 Score: 7.3 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attack
CVSSv3 Score: 8.2 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiManager may allow a remote authenticated attacker with admin permission to elevate their pri
CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient ac
CVSSv3 Score: 8.2 An authentication bypass by spoofing vulnerability (CWE-290) in FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, FortiManager Cloud, FortiSASE-Sovereign
CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially c
Un fallo en FortiAuthenticator permite a atacantes no autenticados agotar recursos del sistema y causar denegación de servicio.
CVSSv3 Score: 9.8 CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high
Exploit público para PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE (CVE-2026-109618).
CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this
Un exploit público permite actualizar el firmware del gateway industrial ProSoft RLX-IFH24E sin verificación de firma, ejecutando código como root de forma remota.
Exploit público para Parasoft Continuous Testing Platform 10.7.5 - JSP command execution.
Se publicó un exploit remoto que permite ejecución de comandos en Exasol Database 7.1.30, sin CVE asociado y autor desconocido.
Un exploit público permite inyección de comandos autenticada en routers Edimax BR-6478AC con firmware 2.20, facilitando control remoto.
Se ha publicado un exploit de inyección SQL para Automotive Shop Management System 1.0, permitiendo a atacantes remotos ejecutar consultas arbitrarias y comprometer la base de datos.
Se ha publicado un exploit de ejecución remota de código para Open eClass 3.15, plataforma de e-learning usada en entornos educativos.
Se publica un PoC que permite tomar el control de cuentas en Keycloak 26.7.2 sin necesidad de credenciales, poniendo en riesgo instancias expuestas.
Exploit público para Synametrics Syncrify 6.2 - command execution.
Exploit público para South River Technologies Titan MFT Server 26.0.0 - code execution.
Se publicó un PoC de inyección SQL en la aplicación web Pizzafy versión 1.0, permitiendo acceso no autorizado a la base de datos.
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker im
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execu
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Re
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnaly
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via
CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via
CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS managem
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted
CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP reques
CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or co
Exploit público para TigerGraph_Community_Edition 4.2.4 - arbitrary file write.
Exploit público para Teltonika_RutOS 00.07.06.21 - command injection.
Exploit público para POMS oretnom23v1.0 - SQLi vulnerabilities.
Exploit público para InvoicePlane 1.7.1 - RCE.
Exploit público para SuiteCRM 8.10.1 - Authenticated SSRF.
Exploit público para Krayin CRM 2.2.4 - IDOR.
Exploit público para Ecava_ntegraXor IGX_16.0.701.10 - RCE.
Una falla de path traversal y null byte en Fortinet permite escritura arbitraria de archivos sin autenticación y ya se explota en la naturaleza.
Exploit público para Food-Ordering 1.0 - LFI.
Exploit público para WordPress 7.0.2 - Path Travesal.
Exploit público para MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE.
Vulnerabilidad de escritura fuera de límites (CWE-787, CVSS 8.3) en el daemon CAPWAP de FortiOS permitiría a un atacante autenticado ejecutar código en el FortiGate.
Fortinet PSIRT reporta un fallo en FortiToken Android que permitiría a otras apps leer los códigos OTP mediante un Content Provider exportado.
Fortinet PSIRT reporta una vulnerabilidad de inyección de comandos (CWE-78) en la CLI de FortiAP y FortiAP-W2 con CVSS 6.5, que permite a un atacante autenticado ejecutar código no autorizado.