Multiple Node.js CVEs

2026-10-27T08:52:15Z•87011de2eee69adeb9b2d2365a3e781c42552502bb7203cb4a5de5a8c838b1c8
CVE-2022-0778CVE-2026-105481CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-106070CVE-2026-106071CVE-2026-106072CVE-2026-106073CVE-2026-106074CVE-2026-109618CVE-2026-109619CVE-2026-111497FortinetNode.jsOpenSSLPHPPSIRTXSSaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectioncritical-vulnerabilitydenial-of-serviceexploited-in-the-wildpath-traversalremote-code-executionsql-injectionvulnerability-advisories

What happened

Fortinet PSIRT advisories covering multiple high-impact vulnerabilities across Fortinet products and third-party components. The collection includes unauthenticated arbitrary file write/path traversal reportedly exploited in the wild, authentication bypasses, remote code execution through command or SQL injection, JWT/static-key authentication weaknesses, denial-of-service flaws, XSS, access-control issues, and Node.js/PHP/OpenSSL vulnerabilities. The most severe issues affect FortiSIEM, FortiSandbox, FortiMonitorOnSight, FortiOS/FortiProxy, FortiManager/FortiAnalyzer, and embedded runtime or!

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
fortinet_blog
Record identifier
87011de2eee69adeb9b2d2365a3e781c42552502bb7203cb4a5de5a8c838b1c8
Enrichment time
2026-10-27T08:52:15Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · Multiple Node.js CVEs · Baitaphish