WS_FTP Server on Windows contains a missing authorization check in its administrative interface. A delegated Host Administrator can exceed their authorized scope, which may allow arbitrary command execution with elevated privileges and full compromise of the underlying server. The attacker needs a valid account with the delegated Host Administrator role, so the risk is mainly from compromised admin accounts, malicious insiders or chaining with another flaw.
Progress Software · WS_FTP Server
Research and translation in progress – available shortly.
WS_FTP Server on Windows before 2024.0.7 and 2025.0.4 may write a user's password in clear text to logs that another administrator can read. That administrator could use the password to gain broader administrative access to the server. Exploitation requires network access and existing high privileges, and the attack complexity is rated high.
Progress Software · WS_FTP Server
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Microsoft Edge (Chromium-based) contains an integer overflow or wraparound (CWE-190) that allows an unauthorized attacker to elevate privileges over a network. According to the CNA record, the CVSS vector requires user interaction (UI:R), so exploitation most likely requires a user to visit a malicious or compromised web page. The CVSS score is 8.8 (CNA) but VulDB rates it 6.3 (Medium), and public technical details are limited.
Microsoft · Edge (Chromium-based)
Microsoft Edge (Chromium-based) contains a use-after-free memory flaw (CWE-416) that allows an authorized attacker to elevate privileges over the network. The CVSS vector rates the impact as high for integrity and availability, with no confidentiality impact. Exploitation requires an attacker who already holds low privileges (PR:L) and no user interaction is required according to the CVSS vector.
Microsoft · Edge (Chromium-based)
Microsoft Edge (Chromium-based) contains a heap-based buffer overflow that allows an unauthenticated remote attacker to execute code. Exploitation requires that a user visits a malicious or compromised web page, for example through phishing or malicious advertising. Microsoft rates the impact as high for confidentiality, integrity and availability, with a CVSS base score of 8.8.
Microsoft · Edge (Chromium-based)
A double free vulnerability (CWE-415) in Microsoft Edge (Chromium-based) allows an unauthorized remote attacker to execute code. The CVSS 3.1 base score is 8.8 and the vector requires user interaction, so a victim would typically need to open a malicious web page or link. The NVD analysis is still pending, and the vendor's fixed build must be verified against the MSRC entry.
Microsoft · Edge (Chromium-based)
Research and translation in progress – available shortly.
Progress WS_FTP Server on Windows, before 2024.0.6 and 2025.0.3, has an MFA bypass in its SSH component. An authenticated user with valid credentials can get past multi-factor authentication because authentication factors are wrongly linked between accounts. The attack complexity is high. The flaw is part of a batch of WS_FTP Server fixes, and a related flaw (CVE-2026-84295, CVSS 10.0) is unauthenticated, so internet-facing servers should be treated as urgent.
Progress Software · WS_FTP Server
The flaw affects Progress Software WS_FTP Server on Windows in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can access sensitive information, including administrative credentials, without user interaction. The CVSS 10.0 score reflects high impact on confidentiality, integrity and availability, with a changed scope. A compromised server could serve as a starting point for attacks on the wider network.
Progress Software · WS_FTP Server
WS_FTP Server on Windows, in the Ad Hoc Transfer component, does not properly limit file paths. An authenticated user with a valid account can access files outside the directories intended for them, which mainly exposes confidential data. The attack requires network access to the server and a low-privileged account. Exploitation has not been observed so far.
Progress Software · WS_FTP Server
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a path traversal vulnerability (CWE-22) that allows a remote attacker with a valid low-privilege account to overwrite arbitrary files on the server. The attack requires no user interaction. The IBM bulletin does not name the affected endpoint or the file types that can be overwritten, and the CVSS impact is limited to integrity. No public exploit or known exploitation was reported at the time of research.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.4 do not properly sanitize secrets when flows and projects are exported. An authenticated attacker with a Langflow account can obtain sensitive information contained in these exports. Only confidentiality is affected; integrity and availability are not.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Zoho Flow plugin for WordPress up to version 2.14.5 contains a PHP Object Injection vulnerability (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to the affected site may manipulate how the site processes data, which can lead to harmful actions on the server, depending on the PHP classes available on the site. No official patch was confirmed at the time of research, and the fixed version is unknown.
Zoho · Flow WordPress plugin
The Gunslinger WordPress theme up to and including version 1.11 is affected by an unauthenticated PHP Object Injection flaw (CWE-502) rated CVSS 9.8 critical. An unauthenticated remote attacker can supply crafted serialized data to the website, which may lead to code execution or manipulation of data on the server, depending on the classes available in installed plugins. The theme is typically used for online shops, so internet-facing sites are most at risk.
ThemeREX · Gunslinger
The Good Homes WordPress theme up to version 1.3.13 is vulnerable to PHP Object Injection through unsafe deserialization of data. An unauthenticated remote attacker can exploit this over the network by sending crafted input to a public website. Depending on the PHP classes available on the site, this can lead to manipulation of data or code execution on the server.
ThemeREX · Good Homes
The Gamic WordPress theme up to version 1.19 is vulnerable to PHP Object Injection (CWE-502), which can be triggered without authentication over the network. An attacker can manipulate how the site processes serialized data, which may allow harmful actions on the server. Whether this leads to code execution or data compromise depends on other installed plugins or themes that provide exploitable gadget chains; this is not established for the theme alone.
ThemeREX · Gamic WordPress Theme
The Gamezone WordPress theme by ThemeREX, up to and including version 1.1.11, contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted data to the website without logging in, which can lead to harmful actions on the server, such as code execution, depending on the gadget classes available in the installation. At the time of writing, no fixed version or vendor advisory has been found, and the NVD status is Deferred.
ThemeREX · Gamezone WordPress theme
The WordPress theme EmojiNation up to and including version 1.0.12 contains a PHP Object Injection vulnerability (CWE-502). It can be triggered over the network without authentication. An attacker can manipulate how the site processes data, which may lead to harmful actions on the server. No fixed version has been confirmed, and NVD lists the status as Deferred.
ThemeREX · EmojiNation theme
The Edge Decor WordPress theme up to and including version 2.9 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). A remote attacker can send crafted serialized data to a vulnerable site without logging in, which can be used to manipulate server-side processing. Whether this leads to code execution depends on the gadget chains available in the theme and other installed plugins.
ThemeREX · Edge Decor
The Coinpress WordPress theme up to and including version 1.0.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who can send crafted input to the affected site may manipulate how data is processed and potentially run harmful actions on the server. The NVD rates this CVSS 3.1 9.8 (Critical), while the VulDB score is 7.3 and Vulners lists 5.9, so the scores differ; plan using the higher value until the Patchstack advisory says otherwise.
ThemeREX · Coinpress
