New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Flexera FlexNet Publisher: Remote code execution in lmadmin web interface

A remote code execution vulnerability exists in the lmadmin web user interface of FlexNet Publisher, licence-management software that runs on licence servers. An attacker with high privileges on the lmadmin interface can execute code on the server, with high impact on confidentiality, integrity and availability. The CVSS vector requires no user interaction, but the attacker needs administrative access to the interface, so exposure of the web UI determines the practical risk.

Flexera · FlexNet Publisher

Microsoft Edge (Chromium-based): Use-after-free allows privilege escalation

A use-after-free vulnerability (CWE-416) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over the network, according to the CNA record. The attack requires user interaction, for example opening a malicious web page. The CVSS 3.1 base score is 8.8 (High), and NVD analysis is still pending.

Microsoft · Edge (Chromium-based)

Microsoft Edge (Chromium-based): Heap-based buffer overflow enables code execution

A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows a remote attacker without privileges to execute code. The victim must take an action, such as visiting a malicious or compromised web page. The CVSS base score is 8.8 (High), but the fixed build is not yet confirmed.

Microsoft · Microsoft Edge (Chromium-based)

Microsoft Edge (Chromium-based): Heap-based buffer overflow allows code execution

A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute code. The CVSS base score is 8.8 (High). Exploitation requires that a user is tricked into interacting, most likely by opening a malicious web page. CISA SSVC lists exploitation as none and automatable as no.

Microsoft · Edge (Chromium-based)

Microsoft Edge (Chromium-based): Security feature bypass via incomplete input filter

Microsoft Edge (Chromium-based) contains a security feature bypass caused by an incomplete list of disallowed inputs (CWE-184). An unauthenticated remote attacker can bypass a browser security feature over the network. Exploitation requires that a user visits a malicious or crafted web page. Microsoft rates the impact as High for confidentiality, integrity and availability.

Microsoft · Edge (Chromium-based)

Microsoft Edge: Use-after-free vulnerability allows remote code execution

A use-after-free vulnerability (CWE-416) in Microsoft Edge allows an unauthorized attacker to execute code over a network. The description also refers to Edge for iOS, while the affected products are listed as Chromium-based Edge. The CNA rates the issue at CVSS 3.1 8.8 with high impact on confidentiality, integrity and availability, and exploitation requires a user to visit a malicious page or perform a similar action but no privileges. VulDB scores the issue lower (6.3), so the severity assessment is inconsistent across sources.

Microsoft · Edge

Research and translation in progress – available shortly.

IBM Langflow OSS: Authentication bypass due to improper authentication

IBM Langflow OSS 1.0.0 through 1.12.8, an open-source tool for building AI agents and workflows, contains an improper authentication flaw (CWE-287). According to IBM, a remote attacker without credentials can bypass security restrictions. IBM groups this issue with other Langflow vulnerabilities, including remote code execution, and a public Metasploit module is reported.

IBM · Langflow OSS

Research and translation in progress – available shortly.

Szafir: XML External Entity (XXE) injection

Szafir and Szafir Weryfikująca, Polish electronic signature applications from Krajowa Izba Rozliczeniowa, process external entities in XML files. When a user signs or verifies a crafted XML file with an external DTD reference, an attacker can read arbitrary files from the victim's system. Exploitation requires the victim to open the file, for example one received by email or download, and no network service is exposed.

Krajowa Izba Rozliczeniowa · Szafir

Langflow Langflow

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Progress WS_FTP Server: OS command injection on Windows

An OS command injection vulnerability in Progress WS_FTP Server on Windows allows arbitrary command execution under certain configurations. The CVSS vector is network-reachable with low attack complexity, but it requires low privileges, so an attacker needs a valid account. The flaw is fixed in the same release as the more severe, unauthenticated CVE-2026-84295, so patching the server addresses both.

Progress Software · WS_FTP Server

Research and translation in progress – available shortly.

Progress WS_FTP Server: Path traversal allows access outside delegated scope

A path traversal flaw in Progress WS_FTP Server on Windows allows a delegated Host Administrator to reach locations outside their authorized scope. The CNA states this could potentially enable remote code execution. The attacker needs a valid Host Administrator account, so the flaw is not exploitable without prior authentication.

Progress Software · WS_FTP Server