NewsFortinet PSIRT
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Teaser from the source
CVSSv3 Score: 9.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00
This is the RSS-feed teaser. Read the full article at the original source.
Read at Fortinet PSIRTMore on Unauthenticated
Other advisories
- Lowghsa:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:CVE-2026-120426OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route
- Not ratedosv:CVE-2026-78192WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page
- Not ratedosv:CLEANSTART-2024-AA52543Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of servic...
- Not ratedosv:CLEANSTART-2024-TP55883Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access
- Not ratedosv:CLEANSTART-2026-BX77379security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by f...
- Not ratedosv:CVE-2026-116522Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
- Not ratedosv:CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
Other news entries
- Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersNewsThe Hacker News
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessNewsThe Hacker News
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
- Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)NewsRapid7
- Anthropic AI model finds Linux kernel bug that leads to remote root accessNewsCSO Online
- Fresh WordPress Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxNewsSecurityWeek
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-166
ID