Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2025-64446 — Fortinet FortiWeb Path Traversal Vulnerability
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
|
Fortinet | FortiWeb | Nov 14, 2025 | Nov 21, 2025 | |
|
CVE-2025-25257 — Fortinet FortiWeb SQL Injection Vulnerability
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
|
Fortinet | FortiWeb | Jul 18, 2025 | Aug 8, 2025 | |
|
CVE-2019-6693 — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
|
Fortinet | FortiOS | Jun 25, 2025 | Jul 16, 2025 | Ransomware |
|
CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
|
Fortinet | Multiple Products | May 14, 2025 | Jun 4, 2025 | |
|
CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
|
Fortinet | FortiOS and FortiProxy | Mar 18, 2025 | Apr 8, 2025 | Ransomware |
|
CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
|
Fortinet | FortiOS and FortiProxy | Jan 14, 2025 | Jan 21, 2025 | Ransomware |
|
CVE-2024-47575 — Fortinet FortiManager Missing Authentication Vulnerability
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
|
Fortinet | FortiManager | Oct 23, 2024 | Nov 13, 2024 | |
|
CVE-2024-23113 — Fortinet Multiple Products Format String Vulnerability
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
|
Fortinet | Multiple Products | Oct 9, 2024 | Oct 30, 2024 | |
|
CVE-2023-48788 — Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
|
Fortinet | FortiClient EMS | Mar 25, 2024 | Apr 15, 2024 | Ransomware |
|
CVE-2024-21762 — Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
|
Fortinet | FortiOS | Feb 9, 2024 | Feb 16, 2024 | Ransomware |
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
FortiWeb · Nov 14, 2025
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
FortiWeb · Jul 18, 2025
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
FortiOS · Jun 25, 2025
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
Multiple Products · May 14, 2025
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
FortiOS and FortiProxy · Mar 18, 2025
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
FortiOS and FortiProxy · Jan 14, 2025
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
FortiManager · Oct 23, 2024
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Multiple Products · Oct 9, 2024
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
FortiClient EMS · Mar 25, 2024
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
FortiOS · Feb 9, 2024