Multiple Node.js CVEs

CVE-2026-106070 · CVE-2026-111497 · CVE-2026-105483 · CVE-2026-105482 · CVE-2026-106071 · CVE-2026-106069 · CVE-2026-106072 · CVE-2026-105481 · CVE-2026-106073 · CVE-2026-106074

CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105

历史摘要 · 未重新核验 · Fortinet PSIRT

PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

CVE-2026-109619 · CVE-2026-109618

CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context

历史摘要 · 未重新核验 · Fortinet PSIRT

Double free in signal handler

CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a loc

历史摘要 · 未重新核验 · Fortinet PSIRT

Fabric API Authentication bypass

CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API m

历史摘要 · 未重新核验 · Fortinet PSIRT

GUI Denial of Service

CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker

历史摘要 · 未重新核验 · Fortinet PSIRT

Multiple Arbitrary File Read/Write via SQL Injection

CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vuln

历史摘要 · 未重新核验 · Fortinet PSIRT

Arbitrary file write in grpc phQueryMaster

CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] i

历史摘要 · 未重新核验 · Fortinet PSIRT

Broken authorization

CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated

历史摘要 · 未重新核验 · Fortinet PSIRT

HTML injection in WebUI

CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and For

历史摘要 · 未重新核验 · Fortinet PSIRT

Improper access control and session management in the web management interface

CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in Forti

历史摘要 · 未重新核验 · Fortinet PSIRT

Persistent Denial of Service in Admin Profile

CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacke

历史摘要 · 未重新核验 · Fortinet PSIRT

SQL command injection in webmail

CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vuln

历史摘要 · 未重新核验 · Fortinet PSIRT

arbitrary command execution in fgfmsd daemon

CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection'

历史摘要 · 未重新核验 · Fortinet PSIRT

Improper limitation of a pathname to a restricted directory

CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22]

历史摘要 · 未重新核验 · Fortinet PSIRT

Improper Authentication of FortiPAM Server

Fortinet PSIRT 发布了一则安全公告（FG-IR-26-168），通报了 FortiPAM Server 中存在的不当认证漏洞（CWE-287）。从公告描述看，该问题出现在 Fortinet Privileged Access

历史摘要 · 未重新核验 · Fortinet PSIRT

Uncontrolled Resource Consumption in SNMP

CVSSv3 Score: 5.9 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daem

历史摘要 · 未重新核验 · Fortinet PSIRT

Null Pointer Dereference in Log Report

CVSSv3 Score: 2.5 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may a

历史摘要 · 未重新核验 · Fortinet PSIRT

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

CVSSv3 Score: 8.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and F

历史摘要 · 未重新核验 · Fortinet PSIRT

ZTNA Portal Improper Certificate Validation

CVSSv3 Score: 7.3 An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentle

历史摘要 · 未重新核验 · Fortinet PSIRT

Arbitrary process termination from exposed minifilter communication port

CVSSv3 Score: 4.7 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may

历史摘要 · 未重新核验 · Fortinet PSIRT