> TODAY'S SUMMARY (19 articles)
Today's cybersecurity landscape is marked by several critical threats and trends. Recently patched vulnerabilities in Barracuda devices are being actively exploited, allowing attackers root access. Cisco's BroadWorks and Openwave flaws are also under attack despite available patches. Apple has addressed Bluetooth and AirPlay vulnerabilities, reinforcing the need for prompt patching as 45% of EU IT service providers delay critical updates. New malware threatens Exchange servers, and leaked exploit kits are compromising iPhones via ads. Additionally, Microsoft released a substantial patch update addressing 1,094 vulnerabilities, including a critical zero-day in Outlook that risks credential theft. Cybersecurity resilience remains a priority as organizations grapple with the rising tide of AI-discovered vulnerabilities.
|
// AI-powered summary generated at 08:00
CVSSv3 Score:
4.4
An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests.
Revised on 2026-0...
CVSSv3 Score:
4.1
A Server-Side request forgery (SSRF) vulnerability [CWE-918] in FortiSOAR may allow an authenticated attacker to discover services running on local ports via crafted requests.
Revised on 2026-04-14 00:00:00
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSiteI'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tic...
CVSSv3 Score:
6.8
An improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted...
CVSSv3 Score:
7.9
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiDDoS-F may allow an authenticated attacker to run arbitrary SQL queries on the database by sending crafted HTTP requests.
Revised on 2026-04-14 00...
The cybersecurity landscape is undergoing a fundamental transformation. Over the past few years, organizations have witnessed a sharp increase in reported vulnerabilities, with global disclosures crossing 20,000+ annually. While this surge may appear alarming, it does not necessarily indicate that s...
CVSSv3 Score:
4.9
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox and FortiSandbox Cloud may allow an attacker to perform an XSS attack via crafted HTTP requests.
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
6.2
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSOAR may allow an authenticated remote attacker to perform path traversal attack via File Content Extraction actions.
Revised on 2026-04-14 00:00:00
Several security issues were fixed in Redis, lua5.1, lua-cjson, lua-bitop.
CVSSv3 Score:
5.4
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI reque...
CVSSv3 Score:
5.4
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager may allow a privileged attacker to achieve arbitrary write or delete files via specifically...
In this Help Net Security interview, Idan Habler, AI Security Researcher at Cisco, breaks down a threat most security teams haven’t named yet: agentic memory as an attack surface. Habler walks through MemoryTrap, a disclosed and remediated method to compromise Claude Code’s memory, showing how a sin...
CVSSv3 Score:
2.2
An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary website via crafted CSV file.
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
9.1
An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Revised on 2026-04-14 00:0...
A critical security vulnerability impacting ShowDoc, a document management and collaboration service popular in China, has come under active exploitation in the wild.
The vulnerability in question is CVE-2025-0520 (aka CNVD-2020-26585), which carries a CVSS score of 9.4 out of 10.0.
It relates to a...
CVSSv3 Score:
4.3
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox and FortiSandbox Cloud may allow a privileged attacker to perform a stored XSS attack via crafted HTTP requests.
Revised on 2026-04-14 00:...
CVSSv3 Score:
7.1
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker to run arbitrary SQL queries on the database via sending crafted requests.
Revised on 2026-04-14 00:...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The list of vulnerabilities is as follows -
CVE-2026-21643 (CVSS score: 9.1) -Â An SQL injection...
CVSSv3 Score:
6.2
Multiple Relative Path Traversal vulnerabilities [CWE-23] in FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
Revised on 2026-04-14 00:00:00
CVSSv3 Score:
6.2
A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, t...