External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiManager & FortiManager Cloud may allow an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests. Revised on 2025-08-13 00:00:00
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
Multiple relative path traversal vulnerabilities [CWE-23] in FortiMail, FortiVoice, FortiRecorder, FortiCamera & FortiNDR may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests. Revised on 2025-08-13 00:00:00
Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
An improper handling of parameters [CWE-233] vulnerability in FortiWeb may allow an unauthenticated remote attacker in possession of non-public information (pertaining to both the device and to the targeted user) to log in as any existing user on the device via a specially crafted request. Revised...
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI commands Revised on 2025-08-12 00:00:00
Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in FortiWeb CLI may allow a privileged attacker to execute arbitrary code or command via crafted CLI commands. Revised on 2025-08-12 00:00:00
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
A double free vulnerability [CWE-415] in FortiOS, FortiProxy & FortiPAM administrative interfaces may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. Revised on 2025-08-12 00:00:00
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.