Unauthenticated FortiManager FGFM flaw allows code execution
An attacker who can reach the FGFM port may run code before the registration password is verified; CVSS 9.0.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #improper-authorization
CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
DolphinScheduler before 3.4.3 lets authenticated users copy or move workflows they are not permitted to access.
CVE-2026-85499: Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
Low-severity CVE-2026-85499 lets readonly Apache SkyWalking BanyanDB users proxy non-read monitoring requests.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.
4
ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Microsoft Exchange privilege-escalation flaw (CVE-2026-62911, CVSS 8.8) where the required authentication can be bypassed.