Two critical vulnerabilities have been identified in Fortinet products. The first, classified under CWE-1389, affects FortiProxy versions 7.4.3 and below, 7.2.10 and below, 7.0.17 and below, as well as FortiOS versions 7.4.3 and below, 7.2.8 and below, and 7.0.15 and below. This vulnerability arises from incorrect parsing of numbers with different radices during IP address validation, which could allow an unauthenticated attacker to bypass the IP blocklist through crafted requests. The second vulnerability, classified under CWE-295, affects FortiWeb versions 7.2.0 through 7.2.1, all versions of 7.0, 6.4, and 6.3. It involves improper certificate validation, which could enable a remote, unauthenticated attacker in a Man-in-the-Middle (MitM) position to intercept and tamper with the communication between the Web Application Firewall (WAF) and its endpoints, compromising data security.