An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
CVE-2026-25585 is a high-severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.3. It involves improper bounds checking during ICC profile processing, specifically in IccCmm.cpp at line 5793, leading to an out-of-bounds read. This flaw can cause memory disclosure or segmentation faults by accessing memory beyond allocated arrays. Exploitation requires a user to open or process a malformed ICC profile, with no privileges needed but user interaction required. The vulnerability impacts confidentiality, integrity, and availability due to potential memory corruption and data leakage. No known exploits are currently reported in the wild, and the issue has been patched in version 2.
CVE-2026-25584 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.3. It occurs in the CIccTagFloatNum<>::GetValues() function when processing specially crafted ICC color profiles, allowing out-of-bounds writes on the stack. This can lead to memory corruption, potentially enabling information disclosure or arbitrary code execution. Exploitation requires local access and user interaction to process a malicious ICC file, but no privileges are needed. The vulnerability has been patched in version 2.3.1.
CVE-2026-25583 is a high-severity heap buffer overflow vulnerability in the iccDEV library, used for handling ICC color profiles. It occurs in the CIccFileIO::Read8() function when processing malformed ICC profile files due to an unchecked fread operation, leading to improper memory bounds restriction. The flaw affects versions prior to 2.3.1.3 and can be triggered by a local attacker with limited privileges and user interaction. Exploitation could result in complete compromise of confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild, but the vulnerability has been patched in version 2.3.1.
CVE-2026-25582 is a heap-based buffer overflow vulnerability in the iccDEV library used for ICC color profile manipulation. It occurs in the CIccIO::WriteUInt16Float() function when converting malformed XML to ICC profiles via the iccFromXml tool. The flaw affects versions prior to 2.3.1.3 and requires user interaction to trigger. Exploitation can lead to high impact on confidentiality, integrity, and availability, including potential remote code execution. The vulnerability has a CVSS score of 7.8 (high severity) and has been patched in version 2.3.
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.
CVE-2026-25502 is a high-severity stack-based buffer overflow vulnerability in the icFixXml() function of the iccDEV library, used for handling ICC color profiles. It affects versions prior to 2.3.1.2 and can be triggered by processing specially crafted NamedColor2 tags in malformed ICC profiles. Exploitation requires local access and user interaction but can lead to arbitrary code execution, compromising confidentiality, integrity, and availability. No known exploits are currently in the wild. European organizations using iccDEV in image processing or color management workflows should prioritize updating to version 2.3.1.
CVE-2026-25503 is a high-severity vulnerability in iccDEV, a library used for handling ICC color management profiles. The flaw arises from incorrect type conversion or casting when processing malformed ICC profiles with invalid icImageEncodingType values. This type confusion leads to undefined behavior, specifically causing denial of service (DoS) by crashing the affected application. The vulnerability affects all iccDEV versions prior to 2.3.1.2 and requires user interaction to trigger, as it involves loading a crafted ICC profile. No known exploits are currently in the wild. The issue has been patched in version 2.3.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
CVE-2026-24852 is a heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.2. The flaw arises when the strlen() function reads a non-null-terminated buffer, potentially causing heap memory over-read, application crashes, and leakage of heap contents. This vulnerability affects applications processing ICC color profiles using vulnerable iccDEV versions. Exploitation requires user interaction and local access, with no known exploits in the wild. The vulnerability has a CVSS score of 6.1 (medium severity), impacting availability and confidentiality but not integrity. The issue is fixed in version 2.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.