CVE-2026-65639: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

PT-2026-89492

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...

Cisco Advance Notification for Publication of September 16, 2026, Security Advisories

On September 16, 2026, the Cisco Product Security Incident Response Team PSIRT published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more...

CVE-2026-70568

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

CVE-2026-68831

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...

EUVD-2026-73648

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70568

This is a heap-based buffer overflow vulnerability in Windows Defender Firewall Service that allows an authorized attacker to achieve local privilege escalation with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector wi...

CVE-2026-68831

CVE-2026-68831 is an information disclosure vulnerability in Windows Defender Firewall Service . The issue arises from files or directories accessible to external parties, allowing an authorized attacker with low privileges to disclose information locally (CVSS 3.1 score 5.5 – MEDIUM ; vector AV:...

EUVD-2026-73398

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...

Windows Defender Firewall Service Information Disclosure Vulnerability

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...

Windows Defender Firewall Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

CVE-2026-70568: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

PT-2026-87805

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally...

PT-2026-87269

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...

CVE-2026-68831: Files or Directories Accessible to External Parties

Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally...

CVE-2026-56128

A flaw was found in pfSense Plus and CE. An authenticated user with the 'Firewall: Schedules: Edit' privilege can inject malicious JavaScript code into the schedule description. This code is stored without proper sanitization and executes in the browser of any user with the 'Firewall: Rules'...

easywall v2.14.0

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. The idea Editing a rule changes nothing. Applying it changes everything — for 120 seconds. If the ne...

CVE-2026-67402: Files or Directories Accessible to External Parties

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

The vulnerability of Fortinet FortiWeb web applications’ network firewalls, related to authentication procedures that allow attackers to bypass existing security restrictions.

The vulnerability of Fortinet FortiWeb network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to bypass existing security restrictions remotely...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall (CSF) by WebPros maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host . A remote unauthenticated attacker whose address is blocked by CSF can request a mapped executable and run arbitrary commands as the Apa...