Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge…Check if you run itEPSS 0.48%Mar 10, 2026
- Medium4.8An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0…Check if you run itEPSS 0.32%Mar 10, 2026
- High7.2An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.…Check if you run itEPSS 0.46%Mar 10, 2026
- Medium5.3An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all…Check if you run itEPSS 0.48%Mar 10, 2026
- High7.2A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyze…Check if you run itEPSS 0.54%Mar 10, 2026
- Medium5.9Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityPatch nowKEVEPSS 29.50%Feb 10, 2026
- Critical9.8Fortinet FortiClient EMS SQL Injection VulnerabilityPatch nowKEVEPSS 93.87%Feb 6, 2026
- UnknownFortinet FortiOS LDAP Credentials DisclosurePatch nowKEVEPSS 0.10%Feb 5, 2026
- Critical9.8Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityPatch nowKEVEPSS 85.80%Jan 27, 2026
- UnknownFortinet FortiSIEM Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 42.54%Jan 15, 2026
- Critical9.8Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityPatch nowKEVEPSS 3.80%Jan 13, 2026
- UnknownFortinet FortiWeb Improper Verification of Cryptographic SignaturePatch nowKEVEPSS 29.22%Dec 15, 2025
- High7.2A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through…Check if you run itEPSS 1.71%Dec 9, 2025
- Medium5.6Fortinet FortiOS Insufficient Session ExpirationPatch nowKEVEPSS 0.30%Dec 9, 2025
- Low2.7An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,…Check if you run itEPSS 0.21%Dec 9, 2025
- Medium6.5An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR…Check if you run itEPSS 0.26%Dec 9, 2025
- Medium6.8An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS…Check if you run itEPSS 0.23%Dec 9, 2025
- Medium6.5An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via craft…Check if you run itEPSS 0.31%Dec 9, 2025
- Critical9.8Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityPatch nowKEVEPSS 68.29%Dec 9, 2025
- High7.2Fortinet FortiWeb OS Command Injection VulnerabilityPatch nowKEVEPSS 55.58%Nov 18, 2025
- UnknownFortinet FortiOS Heap-based Buffer OverflowPatch nowKEVEPSS 0.24%Oct 23, 2025
- Critical9.8Fortinet FortiWeb Path Traversal VulnerabilityPatch nowKEVEPSS 91.97%Oct 6, 2025
- UnknownFortinet FortiWeb Improper Handling of ParametersPatch nowKEVEPSS 10.08%Sep 4, 2025
- UnknownFortinet FortiSIEM Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 65.30%Aug 12, 2025
- Critical9.8Fortinet FortiWeb SQL Injection VulnerabilityPatch nowKEVEPSS 99.81%Jul 11, 2025