Vulnerabilities
Summary — last 7 days
New vulnerabilities2,950▲ 8 vs. last week
Critical / high1,450▲ 184 vs. last week
New active exploitation (KEV)5▼ 3 vs. last week
Unscored (no CVSS)272▼ 254 vs. last week
64 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | High (7.2) | 1.4% | — | Fortinet FortisandboxAI | 9/8/2026 | 9/8/2026 | A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | |
| Awaiting Analysis | Critical (9.9) | 0.39% | — | Fortinet FortisandboxAIFortinet Fortisandbox CloudAIFortinet Fortisandbox PaasAI | 9/8/2026 | 9/8/2026 | A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests. | |
| Analyzed | High (8.6) | 0.40% | — | Fortinet Fortisandbox | 7/14/2026 | 7/15/2026 | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. | |
| Analyzed | Critical (9.8) | 76% | ⚠ Active exploitation | Fortinet FortisandboxFortinet Fortisandbox CloudFortinet Fortisandbox Paas | 6/9/2026 | 7/23/2026 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an… | |
| Analyzed | Critical (9.8) | 0.50% | — | Fortinet FortisandboxFortinet Fortisandbox CloudFortinet Fortisandbox Paas | 5/12/2026 | 7/8/2026 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox… | |
| Modified | Critical (9.8) | 0.72% | — | Fortinet Fortisandbox | 4/14/2026 | 6/18/2026 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests. | |
| Analyzed | Medium (4.8) | 0.24% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 4/14/2026 | 6/17/2026 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all… | |
| Analyzed | Critical (9.8) | 47% | ⚠ Active exploitation | Fortinet Fortisandbox | 4/14/2026 | 7/17/2026 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | |
| Analyzed | Low (2.7) | 0.30% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 4/14/2026 | 6/17/2026 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection. | |
| Analyzed | Medium (6.7) | 0.47% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 4/14/2026 | 6/17/2026 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and… | |
| Analyzed | Medium (5.4) | 0.27% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 4/14/2026 | 6/17/2026 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests. | |
| Modified | High (7.2) | 1.6% | — | Fortinet Fortisandbox Cloud | 3/10/2026 | 6/17/2026 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests. | |
| Analyzed | Medium (4.8) | 0.31% | — | Fortinet Fortisandbox | 3/10/2026 | 6/17/2026 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to… | |
| Analyzed | Critical (9.6) | 6.5% | — | Fortinet Fortisandbox | 2/10/2026 | 6/17/2026 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute… | |
| Analyzed | Low (3.8) | 0.42% | — | Fortinet Fortisandbox | 1/13/2026 | 6/17/2026 | A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via… | |
| Analyzed | Medium (6.1) | 6.3% | — | Fortinet Fortisandbox | 12/9/2025 | 6/17/2026 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via… | |
| Analyzed | High (8.8) | 17% | — | Fortinet Fortisandbox | 12/9/2025 | 6/17/2026 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute… | |
| Analyzed | High (7.2) | 12% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 12/9/2025 | 6/17/2026 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23… | |
| Analyzed | Medium (5.3) | 0.32% | — | Fortinet Fortisandbox | 11/18/2025 | 6/17/2026 | An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file. | |
| Analyzed | Medium (6.7) | 0.47% | — | Fortinet FortiisolatorFortinet Fortisandbox | 7/18/2025 | 6/17/2026 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a… | |
| Analyzed | High (8.8) | 0.50% | — | Fortinet Fortisandbox | 3/24/2025 | 6/17/2026 | A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests. | |
| Analyzed | Medium (4.4) | 0.15% | — | Fortinet Fortisandbox | 3/17/2025 | 6/17/2026 | A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive… | |
| Modified | High (8.8) | 0.42% | — | Fortinet FortisandboxFortinet Fortisandbox Cloud | 3/11/2025 | 6/17/2026 | An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows… | |
| Analyzed | High (7.2) | 10% | — | Fortinet Fortisandbox | 3/11/2025 | 6/17/2026 | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests. | |
| Modified | High (8.8) | 0.55% | — | Fortinet Fortisandbox | 3/11/2025 | 6/17/2026 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0… |