cve

Live7

1. live
   Citrix Citrix and Ivanti release patches for critical and high‑severity vulnerabilities

   Patch now · Disclosed · ●Patched · since 11 Nov 2026 · updated 13 Nov 2026 · CVE-2026-120868

   Citrix and Ivanti disclosed multiple critical and high‑severity vulnerabilities that could allow attackers to tamper with certificate entries, execute code remotely, and compromise hosts. The vendors have issued patches to address the flaws.

   Do:Deploy the NetScaler patches covering CVE‑2026‑120868.
2. live9.0
   FortiManager FortiManager FGFM elevation before registration password verification

   Patch now · Disclosed · since 10 Nov 2026

   An improper authorization flaw in FortiManager's FGFM interface allows an unauthenticated attacker that can reach the FGFM port to execute code via crafted packets before password verification. The issue carries a CVSS v3 score of 9.0, marking it as critical.
3. live9.3
   FortiOS FortiOS/FortiSASE OSPF daemon authentication bypass via crafted LSA

   Patch now · Disclosed · since 10 Nov 2026

   An authentication bypass (CWE‑305) in the OSPF daemon of FortiOS and FortiSASE permits an unauthenticated attacker to broadcast LSAs using specially crafted requests. The vulnerability is assigned a CVSS v3 score of 9.3, indicating critical severity.
4. live9.8
   FortiMail FortiMail path traversal enables unauthorized code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper limitation of a pathname (CWE‑22) in FortiMail allows an unauthenticated attacker to traverse directories and execute unauthorized code via crafted requests. The issue is rated CVSS v3 9.8, marking it as a critical vulnerability.
5. live9.8
   FortiMail FortiMail command injection allows unauthenticated code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper neutralization of special elements in a command (CWE‑77) in FortiMail permits an unauthenticated attacker to execute unauthorized code via crafted HA join‑request packets. The vulnerability carries a CVSS v3 score of 9.8, indicating a critical risk.
6. live9.0
   FortiAuthenticator FortiAuthenticator hard‑coded password enables authentication bypass

   Patch now · Disclosed · since 10 Nov 2026

   A hard‑coded password (CWE‑259) in FortiAuthenticator can be used by an unauthenticated attacker to bypass credential validation. The flaw has a CVSS v3 score of 9.0 and may lead to unauthorized access.
7. live
   OpenSSH OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

   Patch now · Exploited · ●Patched · since 5 Nov 2026 · updated 9 Nov 2026 · CVE-2026-123158

   A critical flaw in OpenSSH allowed authentication bypass using overly long passwords on Alpine Linux servers. The vendor released OpenSSH 10.6p2 to fix the issue and Alpine published patched packages.

   Do:Update OpenSSH to version 10.6p2 and ensure Alpine packages are upgraded

Earlier0

Nothing closed yet.