Missing authorization on log access
CVSSv3 Score: 2.6
A Direct Request ('Forced Browsing') vulnerability in FortiAuthenticator logs may allow an authenticated attacker with at least...
Multiple authenticated SQL injection via extraParam
CVSSv3 Score: 6.8
An improper neutralization of special elements used in an SQL command ('SQL injection') in FortiVoice may allow...
Insufficient Session Expiration in SSLVPN
CVSSv3 Score: 5.3
An Insufficient Session Expiration vulnerability in FortiOS SSLVPN may allow an attacker to maintain access to network...
Private key readable by admin
CVSSv3 Score: 5.9
A key management error vulnerability in FortiManager, FortiAnalyzer and FortiPortal may allow an authenticated admin to retrieve...
Incorrect authorization in multi-vdom environment
CVSSv3 Score: 6.4
An Incorrect Authorization vulnerability in FortiPortal may allow an authenticated attacker to reboot a shared FortiGate device...
Path traversal vulnerability in administrative interface
CVSSv3 Score: 7.7
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities in FortiVoice may allow...
Reflected XSS in HA cluster
CVSSv3 Score: 5.3
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FortiSandbox may allow an...
Multiple authenticated OS Command Injections via API
CVSSv3 Score: 6.7
An OS command injection vulnerabtility in FortiExtender API may allow an authenticated attacker to execute unauthorized code...
OS command injection in multiple endpoints
CVSSv3 Score: 7.0
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in FortiSandbox...
Current password requirement bypass for self password change
CVSSv3 Score: 6.5
An Unverified Password Change vulnerability in FortiSOAR may allow an attacker who gained access to a victim's...
Latest article
Check Point VPN Authentication Bypass Vulnerability
What is the Vulnerability? A critical authentication bypass vulnerability, CVE-2026-50751 (CVSS...
CISA tells agencies to patch smarter, not harder — foreshadowing broader industry practice
Security teams’ patching practices have come under intense pressure over the past year, as active exploitation is up, time-to-exploit windows...
Hackers Abuse Fake Utility Downloads to Install ScreenConnect and Mine Cryptocurrency
Hackers are turning everyday software searches into a trap. A sophisticated cryptojacking campaign is actively targeting users who search for popular PC utilities online,...
Automated Threat Hunting: Turning Threat Intelligence into Executable Hunt Plans
Blake McDermott is Senior Threat Hunter at Rapid7.Every week, threat hunt teams are faced with a steady flow of blogs, advisories, and DFIR reports...
