The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. This code executes when a privileged user views the order in the OrderAdministration portal, potentially leading to privilege escalation or session compromise. The vulnerability has a medium severity score of 5.1 and affects versions up to 7.0.8.6. No patch or remediation information is provided by the vendor.
CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. It allows an attacker to inject JavaScript code via the "searchValue" URL parameter, which executes in the browser of a privileged user who opens a crafted link. This can lead to account takeover or user lockout since administrative users can change passwords without needing the old password. Version 7.0.8.6 and earlier versions are affected. The vulnerability has a medium severity score of 5.1. No patch or remediation information is currently available from the vendor.
CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This code is stored and executed in the browsers of other privileged users viewing the affected user entries or user group overviews. The vulnerability affects versions from 0 up to and including 7.0.8.6. It requires authenticated access with high privileges and user interaction to trigger. No patch or remediation information is provided by the vendor.
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
libsmi versions up to 0.5.0 contain an out-of-bounds write vulnerability in the smiValueAsString() function. This flaw allows an attacker to overflow a fixed 1024-byte static buffer by supplying a crafted MIB with an OCTET STRING default value of 512 or more octets starting with a 0x00 byte. The overflow can corrupt adjacent library globals and cause crashes in smidump or other consumers.
MuJS versions 1.3.6 through 1.3.8 contain a heap out-of-bounds read and write vulnerability in the Array.prototype.sort function. This flaw allows an attacker to corrupt memory by inflating a dense array's length and invoking sort, which causes internal functions to access memory beyond allocated buffers, potentially crashing the process.
CVE-2026-106175 is a low-severity denial of service vulnerability in Fortinet FortiSwitch and related Fortinet products. It is caused by a double free flaw that may allow a local authenticated attacker to crash the newcli daemon by sending crafted CLI commands. The vulnerability affects multiple versions of FortiSwitch, FortiOS, and FortiProxy. An official fix is available to address this issue.
CVE-2026-106172 is a medium severity vulnerability in Fortinet FortiSandbox versions 4.4.x, 5.0.x, and 5.2.x, including certain Cloud versions. It involves the use of a hard-coded cryptographic key that may allow an attacker to escalate privileges via specially crafted HTTP requests. An official fix is available for this issue.
CVE-2026-23707 is an SQL Injection vulnerability affecting multiple versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud products. It allows a low privileged user to execute arbitrary commands via crafted requests. The vulnerability has a CVSS score of 6.5, indicating medium severity. An official fix is available for the affected versions.
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiManager 7.6.0 through 7.6.2, FortiManager 7.4.0 through 7.4.6 may allow a low privileged user to execute arbitrary commands via crafted requests.
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
CVE-2025-46773 is a high-severity SQL Injection vulnerability in Fortinet FortiAnalyzer and FortiAnalyzer Cloud versions 7.2.x, 7.4.x, and 7.6.x. It allows a low privileged user to execute arbitrary commands via crafted requests. The vulnerability affects multiple specific version ranges of FortiAnalyzer and FortiAnalyzer Cloud. An official fix is available from the vendor.
CVE-2025-57739 is a high-severity SQL Injection vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3. It allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests. The vulnerability has an official fix available.
CVE-2026-106170 is a denial of service vulnerability in Fortinet FortiSandbox versions 4.4.0 through 4.4.10, 5.0.0 through 5.0.6, and 5.2.0 through 5.2.1. It allows a privileged attacker to cause persistent denial of access to the GUI and CLI by sending crafted HTTP requests. The vulnerability is due to an uncaught exception. An official fix is available.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2026-106176 is a missing authorization vulnerability in Fortinet FortiSIEM versions 6.4.0 through 7.5.1 that may allow an attacker with high privileges to execute unauthorized code or commands via specially crafted HTTP requests. The vulnerability has a low severity score of 3.4 and does not impact confidentiality but may affect integrity and availability. An official patch is available to remediate this issue.
CVE-2026-106171 is an OS command injection vulnerability in Fortinet FortiManager versions 7.6.0 through 7.6.6, 7.6.2 through 7.6.6 (FortiManager Cloud), and 8.0.0. This flaw allows an attacker with high privileges to escalate their privileges by sending specially crafted packets. The vulnerability has a medium severity rating and a CVSS score of 5.3. An official fix is available from Fortinet.
Kortix Suna versions from 0.10.7 up to but not including 0.13.52 contain a server-side request forgery (SSRF) vulnerability. This flaw allows project managers with write permissions on project connectors to bypass IP address restrictions by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. Exploiting this, attackers can set connector URLs to access internal services and cloud metadata endpoints, potentially reading sensitive responses. The vulnerability has a low CVSS 4.0 score of 2.3, indicating limited impact and exploitability.