https://vulnfeed.it Daily security vulnerability feed — NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub, OpenStack en-us Tue, 04 Aug 2026 17:55:00 +0000 https://lists.debian.org/debian-security-announce/2026/msg00314.html [SECURITY] [DSA 6403-1] nss security update Wed, 29 Jul 2026 19:58:57 +0000 https://lists.debian.org/debian-security-announce/2026/msg00314.html https://ubuntu.com/security/notices/USN-8624-1 It was discovered that Sinatra did not properly handle header parsing, causing ETag generation to hang when given specific input. A remote attacker could possibly use this issue to cause a denial of service. Wed, 29 Jul 2026 19:09:19 +0000 https://ubuntu.com/security/notices/USN-8624-1 https://ubuntu.com/security/notices/USN-8623-1 Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Arm Firmware Framework for ARMv8-A(FFA); (CVE-2026-53354, CVE-2026-64520) Wed, 29 Jul 2026 13:53:58 +0000 https://ubuntu.com/security/notices/USN-8623-1 https://ubuntu.com/security/notices/USN-8622-1 Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Arm Firmware Framework for ARMv8-A(FFA); (CVE-2026-53354, CVE-2026-64520) Wed, 29 Jul 2026 13:50:57 +0000 https://ubuntu.com/security/notices/USN-8622-1 https://ubuntu.com/security/notices/USN-8620-2 Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local at Wed, 29 Jul 2026 07:46:56 +0000 https://ubuntu.com/security/notices/USN-8620-2 https://ubuntu.com/security/notices/USN-8615-2 It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - InfiniBand drivers; - STMicroelectronics net Wed, 29 Jul 2026 07:43:21 +0000 https://ubuntu.com/security/notices/USN-8615-2 https://fortiguard.fortinet.com/psirt/FG-IR-26-127 CVSSv3 Score: 6.7 An out-of-bounds write vulnerability [CWE-787] in FortiWeb CGI daemon may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests. Revised on 2026-04-15 00:00:00 Wed, 15 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-127 https://fortiguard.fortinet.com/psirt/FG-IR-26-139 CVSSv3 Score: 7.8 CVE-2026-31431In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. Revised on 2026-05-13 00:00:00 Wed, 13 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-139 https://fortiguard.fortinet.com/psirt/FG-IR-26-144 CVSSv3 Score: 7.9 Linux kernel is impacted by CVE-2026-43284 and CVE-2026-43500 which chained together create the Dirty Frag vulnerability.CVE-2026-43284In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv Wed, 03 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-144 https://ubuntu.com/security/notices/USN-8561-2 USN-8561-1 fixed vulnerabilities in FreeRDP. Unfortunately, the upgrade to version 3.30.0 introduced a regression in the clipboard functionality. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code. Tue, 28 Jul 2026 18:08:13 +0000 https://ubuntu.com/security/notices/USN-8561-2 https://fortiguard.fortinet.com/psirt/FG-IR-25-545 CVSSv3 Score: 1.8 An Improper Privilege Management vulnerability [CWE-269] in FortiOS, FortiProxy and FortiPAM may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command. Revised on 2026-05-27 00:00:00 Tue, 18 Nov 2025 08:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-25-545 https://fortiguard.fortinet.com/psirt/FG-IR-24-452 CVSSv3 Score: 2.6 An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command. Revised on 2026-06-08 00:00:00 Tue, 14 Oct 2025 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-24-452 https://fortiguard.fortinet.com/psirt/FG-IR-26-154 CVSSv3 Score: 4.1 A buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-154 https://fortiguard.fortinet.com/psirt/FG-IR-26-149 CVSSv3 Score: 5.3 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-149 https://fortiguard.fortinet.com/psirt/FG-IR-26-152 CVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-152 https://fortiguard.fortinet.com/psirt/FG-IR-26-153 CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-153 https://fortiguard.fortinet.com/psirt/FG-IR-26-147 CVSSv3 Score: 6.7 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-147 https://fortiguard.fortinet.com/psirt/FG-IR-26-146 CVSSv3 Score: 7.0 An out of bounds read [CWE-125] vulnerability in FortiAuthenticator may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-146 https://fortiguard.fortinet.com/psirt/FG-IR-26-151 CVSSv3 Score: 5.0 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted CLI commands. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-151 https://fortiguard.fortinet.com/psirt/FG-IR-26-150 CVSSv3 Score: 6.1 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-150 https://fortiguard.fortinet.com/psirt/FG-IR-26-148 CVSSv3 Score: 5.9 A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS, FortiProxy and FortiPAM may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-148 https://fortiguard.fortinet.com/psirt/FG-IR-26-155 CVSSv3 Score: 6.9 An Improper Restriction of Communication Channel to Intended Endpoints [CWE-923] vulnerability in FortiSIEM Windows Agent may allow an unauthorized attacker on the same local network to execute arbitrary code via spoofing the supervisors hostname when the Windows device is configured with the 'Supers Override' feature. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-155 https://fortiguard.fortinet.com/psirt/FG-IR-26-145 CVSSv3 Score: 7.7 An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSandbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-145 https://fortiguard.fortinet.com/psirt/FG-IR-26-101 CVSSv3 Score: 6.7 An Improper authentication vulnerability [CWE-287] in FortiSOAR web GUI may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-101 https://fortiguard.fortinet.com/psirt/FG-IR-26-115 CVSSv3 Score: 6.2 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS and FortiSandbox Cloud WEB UI may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-115 https://fortiguard.fortinet.com/psirt/FG-IR-26-126 On March 31, 2026, the Axios npm package was compromised via a maintainer account takeover. Two malicious versions were published - axios@1.14.1 and axios@0.30.4 - which introduced a hidden dependency (plain-crypto-js@4.2.1) able to execute a post‑install script deploying a cross‑platform Remote Access Trojan (RAT) on Windows, macOS, and Linux systems. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-126 https://fortiguard.fortinet.com/psirt/FG-IR-26-105 CVSSv3 Score: 4.1 A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-105 https://fortiguard.fortinet.com/psirt/FG-IR-26-104 CVSSv3 Score: 4.1 A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-104 https://fortiguard.fortinet.com/psirt/FG-IR-26-106 CVSSv3 Score: 6.2 A Cleartext Transmission of Sensitive Information vulnerability [CWE-319] in FortiSOAR may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-106 https://fortiguard.fortinet.com/psirt/FG-IR-26-113 CVSSv3 Score: 2.5 An Insufficiently protected credentials vulnerability [CWE-522] in FortiSanbox and FortiSanbox PaaS GUI may allow an authenticated administrator to read LDAP server credentials via client-side inspection. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-113 https://fortiguard.fortinet.com/psirt/FG-IR-26-107 CVSSv3 Score: 5.2 A use of hard-coded cryptographic key vulnerability [CWE 321] in FortiClientEMS may allow an attacker in possession of an encrypted dump of the database to decrypt it. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-107 https://fortiguard.fortinet.com/psirt/FG-IR-26-121 CVSSv3 Score: 7.3 A heap-based buffer overflow vulnerability [CWE-122] in FortiAnalyzer Cloud oftpd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-121 https://fortiguard.fortinet.com/psirt/FG-IR-26-108 CVSSv3 Score: 4.4 An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiWeb may allow a privileged authenticated attacker to perform a denial of service of the system via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-108 https://fortiguard.fortinet.com/psirt/FG-IR-26-125 CVSSv3 Score: 6.2 A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, this attack requires the targeted FortiGate device to run a specific, non default configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-125 https://fortiguard.fortinet.com/psirt/FG-IR-26-114 CVSSv3 Score: 6.2 Multiple Relative Path Traversal vulnerabilities [CWE-23] in FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-114 https://fortiguard.fortinet.com/psirt/FG-IR-26-102 CVSSv3 Score: 7.1 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker to run arbitrary SQL queries on the database via sending crafted requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-102 https://fortiguard.fortinet.com/psirt/FG-IR-26-110 CVSSv3 Score: 4.3 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox and FortiSandbox Cloud may allow a privileged attacker to perform a stored XSS attack via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-110 https://fortiguard.fortinet.com/psirt/FG-IR-26-100 CVSSv3 Score: 9.1 An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-100 https://fortiguard.fortinet.com/psirt/FG-IR-26-118 CVSSv3 Score: 2.2 An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary website via crafted CSV file. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-118 https://fortiguard.fortinet.com/psirt/FG-IR-26-122 CVSSv3 Score: 5.4 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager may allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-122 https://fortiguard.fortinet.com/psirt/FG-IR-26-138 CVSSv3 Score: 4.0 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability [CWE-88] in FortiDeceptor WEB UI may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-138 https://fortiguard.fortinet.com/psirt/FG-IR-26-131 CVSSv3 Score: 6.1 An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] in FortiAP, FortiAP-U & FortiAP-W2 CLI may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-131 https://fortiguard.fortinet.com/psirt/FG-IR-26-137 CVSSv3 Score: 5.2 A use of potentially Dangerous Function vulnerability [CWE-676] in FortiAnalyzer and FortiManager API may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-137 https://fortiguard.fortinet.com/psirt/FG-IR-26-129 CVSSv3 Score: 2.1 A Missing Authorization [CWE-862] in FortiClient Windows may allow an authenticated local attacker to decrypt a currently logged in users VPN password via use of an unprotected DLL function. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-129 https://fortiguard.fortinet.com/psirt/FG-IR-26-128 CVSSv3 Score: 9.1 An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-128 https://fortiguard.fortinet.com/psirt/FG-IR-26-136 CVSSv3 Score: 9.1 A missing authorization vulnerability [CWE-862] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-136 https://fortiguard.fortinet.com/psirt/FG-IR-26-133 CVSSv3 Score: 6.5 An OS command injection vulnerabtility [CWE-78] in FortiAP and FortiAP-W2 cli may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-133 https://fortiguard.fortinet.com/psirt/FG-IR-26-130 CVSSv3 Score: 5.0 An improper export of Android application components [CWE-926] in FortiTokenAndroid may allow other applications on the device to read the OTP code via an exported Content Provider URI. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-130 https://fortiguard.fortinet.com/psirt/FG-IR-26-123 CVSSv3 Score: 8.3 An Out-Of-Bounds Write vulnerability [CWE-787] in FortiOS capwap daemon may allow an attacker controlling an authenticated FortiAP FortiExtender or FortiSwitch to gain execution privileges on the FortiGate device Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-123 https://fortiguard.fortinet.com/psirt/FG-IR-26-132 CVSSv3 Score: 6.3 An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiMail may allow an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-132 https://fortiguard.fortinet.com/psirt/FG-IR-26-134 CVSSv3 Score: 5.1 An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability [CWE-89] in FortiNDR may allow an authenticated attacker to execute arbitrary SQL commands on selected databases and tables via specifically crafted HTTP requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-134 https://fortiguard.fortinet.com/psirt/FG-IR-25-1052 CVSSv3 Score: 7.5 An Authentication Bypass by Primary Weakness vulnerability [CWE-305] in FortiOS fnbamd may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, under specific LDAP server configuration. Revised on 2026-07-04 00:00:00 Tue, 10 Feb 2026 08:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-25-1052 https://fortiguard.fortinet.com/psirt/FG-IR-26-140 CVSSv3 Score: 6.2 An improper access control vulnerability [CWE-284] in FortiPortal API endpoints may allow a remote privileged attacker with organization user role to obtain sensitive network configuration data via crafted HTTP requests. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-140 https://fortiguard.fortinet.com/psirt/FG-IR-26-143 CVSSv3 Score: 6.0 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-143 https://fortiguard.fortinet.com/psirt/FG-IR-26-141 CVSSv3 Score: 9.1 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-141 https://ubuntu.com/security/notices/USN-8625-1 It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte" denial of service. Thu, 30 Jul 2026 13:38:32 +0000 https://ubuntu.com/security/notices/USN-8625-1 https://lists.debian.org/debian-security-announce/2026/msg00315.html [SECURITY] [DSA 6404-1] expat security update Thu, 30 Jul 2026 08:38:59 +0000 https://lists.debian.org/debian-security-announce/2026/msg00315.html https://lists.debian.org/debian-security-announce/2026/msg00321.html [SECURITY] [DSA 6410-1] libssh security update Sun, 02 Aug 2026 07:37:01 +0000 https://lists.debian.org/debian-security-announce/2026/msg00321.html https://lists.debian.org/debian-security-announce/2026/msg00320.html [SECURITY] [DSA 6409-1] libgd2 security update Sat, 01 Aug 2026 09:24:47 +0000 https://lists.debian.org/debian-security-announce/2026/msg00320.html https://lists.debian.org/debian-security-announce/2026/msg00319.html [SECURITY] [DSA 6408-1] chromium security update Sat, 01 Aug 2026 00:55:58 +0000 https://lists.debian.org/debian-security-announce/2026/msg00319.html https://lists.debian.org/debian-security-announce/2026/msg00318.html [SECURITY] [DSA 6407-1] incus security update Fri, 31 Jul 2026 21:35:24 +0000 https://lists.debian.org/debian-security-announce/2026/msg00318.html https://lists.debian.org/debian-security-announce/2026/msg00317.html [SECURITY] [DSA 6406-1] php8.4 security update Fri, 31 Jul 2026 21:17:27 +0000 https://lists.debian.org/debian-security-announce/2026/msg00317.html https://ubuntu.com/security/notices/USN-8620-4 Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local at Fri, 31 Jul 2026 15:00:56 +0000 https://ubuntu.com/security/notices/USN-8620-4 https://lists.debian.org/debian-security-announce/2026/msg00316.html [SECURITY] [DSA 6405-1] linux security update Fri, 31 Jul 2026 14:14:07 +0000 https://lists.debian.org/debian-security-announce/2026/msg00316.html https://ubuntu.com/security/notices/USN-8620-3 Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896) It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local at Fri, 31 Jul 2026 09:40:09 +0000 https://ubuntu.com/security/notices/USN-8620-3 https://github.com/advisories/GHSA-chm3-vqcf-52rx # Summary These endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s `credentialId`, they can use that workspace’s OpenAI key. # Details Route permissions (`assistants:*`) only check feature access. They do not check credential ownership. The controller passes `req.query.credential` straight to the service. T Tue, 04 Aug 2026 17:51:48 +0000 https://github.com/advisories/GHSA-chm3-vqcf-52rx https://github.com/advisories/GHSA-4j8x-x6v7-w9rq ### Summary Flowise's `CSVAgent` interpolates an attacker-controlled segment of the `csvFile` data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default `js` bridge to `globalThis` (which on Node.js exposes `eval` and dynamic `import()`), the attacker can break out of the Python string literal, hand a JS string to `js.eval`, dynamically import any Node built-in module (`fs`, `child_process`, …), and execute arbitrary file I/O Tue, 04 Aug 2026 17:43:48 +0000 https://github.com/advisories/GHSA-4j8x-x6v7-w9rq https://github.com/advisories/GHSA-88pr-878c-24wf ## Summary Flowise on current `main` allows an authenticated user with `documentStores:preview-process` permission to trigger the `S3 Directory` Tue, 04 Aug 2026 17:43:45 +0000 https://github.com/advisories/GHSA-88pr-878c-24wf https://github.com/advisories/GHSA-8r8h-6vcc-xhrv ## Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view) ### What’s wrong (code locations) - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976 - $vars is always injected into the code execution sandbox: flowise-src/packages Tue, 04 Aug 2026 17:43:36 +0000 https://github.com/advisories/GHSA-8r8h-6vcc-xhrv https://github.com/advisories/GHSA-52fh-8v99-63c2 ### Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent). ### Details packages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPyth Tue, 04 Aug 2026 17:31:09 +0000 https://github.com/advisories/GHSA-52fh-8v99-63c2 https://nvd.nist.gov/vuln/detail/CVE-2026-69263 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install Tue, 04 Aug 2026 17:17:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69263 https://nvd.nist.gov/vuln/detail/CVE-2026-69262 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller wi Tue, 04 Aug 2026 17:17:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69262 https://nvd.nist.gov/vuln/detail/CVE-2026-69259 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to Tue, 04 Aug 2026 17:17:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69259 https://nvd.nist.gov/vuln/detail/CVE-2026-69258 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of an Tue, 04 Aug 2026 17:17:01 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69258 https://nvd.nist.gov/vuln/detail/CVE-2026-69257 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4 CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTT Tue, 04 Aug 2026 17:17:00 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69257 https://nvd.nist.gov/vuln/detail/CVE-2026-69256 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as p Tue, 04 Aug 2026 17:17:00 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69256 https://nvd.nist.gov/vuln/detail/CVE-2026-69255 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before calling Pyodide. The validatePythonCodeForDataFrame() denylist only checked later LLM-generated code and did not validate this initial code block. An authenticated Tue, 04 Aug 2026 17:17:00 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-69255 https://nvd.nist.gov/vuln/detail/CVE-2026-64634 A vulnerability allowing local privilege escalation to the Reporter service context. Tue, 04 Aug 2026 17:16:58 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-64634 https://nvd.nist.gov/vuln/detail/CVE-2026-64633 A vulnerability allowing remote unauthenticated code execution on the agent host. Tue, 04 Aug 2026 17:16:58 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-64633 https://nvd.nist.gov/vuln/detail/CVE-2026-64631 A vulnerability allowing a low-privileged user to inject SQL and extract database contents. Tue, 04 Aug 2026 17:16:58 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-64631 https://nvd.nist.gov/vuln/detail/CVE-2026-64630 A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link. Tue, 04 Aug 2026 17:16:57 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-64630 https://nvd.nist.gov/vuln/detail/CVE-2026-63456 Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system. Tue, 04 Aug 2026 17:16:57 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-63456 https://nvd.nist.gov/vuln/detail/CVE-2026-63455 Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system. Tue, 04 Aug 2026 17:16:57 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-63455 https://nvd.nist.gov/vuln/detail/CVE-2026-58075 A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally. Tue, 04 Aug 2026 17:16:57 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58075 https://nvd.nist.gov/vuln/detail/CVE-2026-58074 A vulnerability allowing a high-privileged user to execute arbitrary code on the server. Tue, 04 Aug 2026 17:16:57 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58074 https://nvd.nist.gov/vuln/detail/CVE-2026-58073 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. Tue, 04 Aug 2026 17:16:56 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58073 https://nvd.nist.gov/vuln/detail/CVE-2026-58072 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. Tue, 04 Aug 2026 17:16:56 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58072 https://nvd.nist.gov/vuln/detail/CVE-2026-58071 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins. Tue, 04 Aug 2026 17:16:56 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58071 https://nvd.nist.gov/vuln/detail/CVE-2026-58067 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. Tue, 04 Aug 2026 17:16:56 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-58067 https://nvd.nist.gov/vuln/detail/CVE-2026-56848 A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. Tue, 04 Aug 2026 17:16:56 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-56848 https://nvd.nist.gov/vuln/detail/CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a que Tue, 04 Aug 2026 17:16:55 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-48121 https://nvd.nist.gov/vuln/detail/CVE-2026-18787 A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. Tue, 04 Aug 2026 17:16:48 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-18787 https://nvd.nist.gov/vuln/detail/CVE-2026-18785 A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability. Tue, 04 Aug 2026 17:16:48 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-18785 https://nvd.nist.gov/vuln/detail/CVE-2026-18784 A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability. Tue, 04 Aug 2026 17:16:48 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-18784 https://nvd.nist.gov/vuln/detail/CVE-2026-18775 A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Tue, 04 Aug 2026 17:16:48 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-18775 https://nvd.nist.gov/vuln/detail/CVE-2026-18774 A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Tue, 04 Aug 2026 17:16:48 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-18774 https://nvd.nist.gov/vuln/detail/CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `Model Tue, 04 Aug 2026 17:16:46 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-15920 https://nvd.nist.gov/vuln/detail/CVE-2026-15830 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Ea Tue, 04 Aug 2026 17:16:46 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-15830 https://nvd.nist.gov/vuln/detail/CVE-2026-15337 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_M Tue, 04 Aug 2026 17:16:46 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-15337 https://nvd.nist.gov/vuln/detail/CVE-2026-15314 Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition. Tue, 04 Aug 2026 17:16:46 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-15314