CVE-2026-107656

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...

CVE-2026-107656

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...

EUVD-2026-109831

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...

CVE-2026-107656

An authentication bypass vulnerability (CWE-288) exists in the FortiSandbox web management interface, affecting versions 4.4.0 through 4.4.9 , 5.0.0 through 5.0.6 , and FortiSandbox PaaS versions 4.4.x and earlier (specifically 4.4.0-4.4.9 and 5.0.0-5.0.6). The flaw is caused by hard-coded creden...

SolarView Compact 6.00 - OS Command Injection

SolarView Compact 6.00 was discovered to contain a command injection vulnerability, attackers can execute commands by bypassing internal restrictions through downloader.php. id: CVE-2023-23333 info: name: SolarView Compact 6.00 - OS Command Injection author: Mr-xn severity: critical description: ...

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

FortiWLM - Directory Traversal

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests. id: CVE-2023-34990 info: name: FortiWLM - Directory Traversal author: DhiyaneshDk severity: critical...

VulnCheck KEV: CVE-2026-106173

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...

Fortinet FortiSIEM 6.4.x <= 7.2.7 / 7.3.x <= 7.3.5 / 7.4.x <= 7.4.2 / 7.5.x <= 7.5.1 Missing Authorization (FG-IR-26-183)

The version of Fortinet FortiSIEM running on the remote host is 6.4.x through 7.2.7, 7.3.x through 7.3.5, 7.4.x through 7.4.2, or 7.5.x through 7.5.1. It is, therefore, affected by a missing authorization vulnerability: - A missing authorization vulnerability in FortiSIEM GUI may allow an...

Vulnerabilities handled in Fortinet FortiSIEM

Fortinet has identified vulnerabilities in FortiSIEM version 7.5.0. The first vulnerability involves a path traversal issue, where the system does not impose sufficient restrictions on pathnames leading to restricted directories. This allows unauthorized attackers to send specially crafted packet...

CVE-2026-26245

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-26245

A SQL injection vulnerability (CWE-89) exists in the Video Station application within the class_videos.php file's getSmartVideosByOffset function. If a remote attacker obtains a valid user account, they can exploit this flaw to execute unauthorized code or commands . The vulnerability is addresse...

CVE-2026-26244

A SQL injection vulnerability exists in the Video Station application, specifically within the class_videos.php _getFilters component. If a remote attacker obtains a valid user account, they can exploit this flaw to execute unauthorized code or commands. The vulnerability has been addressed in Vi...

CVE-2026-26245: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-26244: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

hplip: HP Linux Imaging and Printing Software - Use of DSA Key

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability is due to the use of a weak Digital Signature Algorithm DSA for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or...

hplip: HP Linux Imaging and Printing Software - Use of DSA Key

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability is due to the use of a weak Digital Signature Algorithm DSA for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

CVE-2025-57739

An improper neutralization of special elements used in an SQL Command "SQL Injection" vulnerability CWE-89 vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or command...

CVE-2026-106173

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets...