CVE-2025-22258

CVE-2025-22258 is a heap-based buffer overflow affecting Fortinet products: FortiSRA (versions 1.5.0, 1.4.0–1.4.2), FortiPAM (1.5.0, 1.4.0–1.4.2, 1.3.0–1.3.1, 1.2.0, 1.1.0–1.1.2, 1.0.0–1.0.3), FortiProxy (7.6.0–7.6.1, 7.4.0–7.4.7), FortiOS (7.6.0–7.6.2, 7.4.0–7.4.6, 7.2.0–7.2.10, 7.0.2–7.0.16), a...

CVE-2025-22258

A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0...

CVE-2025-57740

An Heap-based Buffer Overflow vulnerability CWE-122 in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions an...

CVE-2025-57740

An Heap-based Buffer Overflow vulnerability CWE-122 in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions an...

CVE-2025-47890

CVE-2025-47890 describes an open redirect (URL Redirection to Untrusted Site, CWE-601) in Fortinet FortiOS and FortiProxy. Affected products include FortiOS versions 6.4, 7.0, 7.2, 7.4, 7.6 and FortiProxy 7.0–7.6.3, plus FortiSASE 25.2.a. The vulnerability can be exploited by unauthenticated, cra...

CVE-2025-47890

An URL Redirection to Untrusted Site vulnerabilities CWE-601 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7....

CVE-2025-49201

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands...

CVE-2025-49201

CVE-2025-49201 concerns Fortinet FortiPAM (versions 1.0.0–1.5.0) and FortiSwitchManager (7.2.0–7.2.4). Multiple sources confirm a weak authentication mechanism that enables an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests, i.e., remote code execution...

CVE-2025-49201

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands...

CVE-2025-58324

FortiSIEM is affected by CVE-2025-58324 in versions 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, and 6.x all versions. The issue is an improper neutralization of input during web page generation (CWE-79) that may allow an authenticated attacker to perform a stored cross-site scripting...

CVE-2025-47856

Two improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests...

CVE-2025-47856

Two improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests...

Description of the security update for SharePoint Server 2019: October 14, 2025 (KB5002796)

None None...

CVE-2025-47856

Two improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests...

CVE-2025-47856

Fortinet FortiVoice is affected by an OS command injection vulnerability (CWE-78) caused by improper neutralization of specific elements. Impacted versions include FortiVoice 7.0.0 through 7.0.6 and 7.2.0 with pre-6.4.10. An authenticated or privileged attacker could potentially execute arbitrary...

CVE-2025-9177

A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server. This could result in a web server crash however; this does not impact I/O control or communication . A power cycle is required to recover...

CVE-2025-9066

A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service...

CVE-2025-9177

Rockwell Automation 1715 EtherNet/IP Comms Module/Adapter is affected by CVE-2025-9177. A denial-of-service vulnerability arises from a high volume of requests to the device's web server, which can cause the web server to crash. Impact described across sources: requires a power cycle to recover a...

CVE-2025-9066 Rockwell Automation FactoryTalk® ViewPoint XXE to Denial-of-Service Vulnerability

A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service...

CVE-2025-9066

Summary: CVE-2025-9066 affects Rockwell Automation’s FactoryTalk ViewPoint. Unauthenticated attackers can abuse SOAP requests to trigger XML External Entity (XXE) processing, resulting in a temporary denial-of-service. The vulnerability is documented across multiple sources (NVD, Rockwell advisor...