NewsFortinet PSIRT10.11.2026

Improper neutralization of special elements used in an OS command

CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) vulnerability [CWE-78] in FortiMail may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root. Revised on 2026-11-10 00:00:00

Other advisories

HighCVE-2026-127036Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
Not ratedCVE-2026-123765Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup…
MediumCVE-2026-40820A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of spe…
CriticalCVE-2026-76954An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-…
MediumCVE-2026-92379An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009…
MediumCVE-2026-81557An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and …
MediumCVE-2026-13656An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 a…
MediumCVE-2026-86343An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allow…

Other news entries

Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-197

More on neutralization

Other advisories

Other news entries