New vulnerabilities – clearly explained

Progress WS_FTP Server: OS command injection on Windows

An OS command injection vulnerability in Progress WS_FTP Server on Windows allows arbitrary command execution under certain configurations. The CVSS vector is network-reachable with low attack complexity, but it requires low privileges, so an attacker needs a valid account. The flaw is fixed in the same release as the more severe, unauthenticated CVE-2026-84295, so patching the server addresses both.

Progress Software · WS_FTP Server

Research and translation in progress – available shortly.

Progress WS_FTP Server: Path traversal allows access outside delegated scope

A path traversal flaw in Progress WS_FTP Server on Windows allows a delegated Host Administrator to reach locations outside their authorized scope. The CNA states this could potentially enable remote code execution. The attacker needs a valid Host Administrator account, so the flaw is not exploitable without prior authentication.

Progress Software · WS_FTP Server

Progress WS_FTP Server: OS command injection allows command execution

WS_FTP Server on Windows contains an OS command injection vulnerability in versions before 2024.0.7 and 2025.0.4. Under certain configurations, an attacker can execute arbitrary commands with elevated privileges. The CNA scores the issue as critical (CVSS 9.0); the vector indicates network access without privileges or user interaction, but with high complexity.

Progress Software · WS_FTP Server

Progress WS_FTP Server: Path traversal by delegated Host Administrator

A path traversal vulnerability (CWE-22) in Progress WS_FTP Server on Windows allows a delegated Host Administrator to access or modify files outside their authorized scope. The attacker needs an existing Host Administrator delegation, which the CVSS vector rates as high privileges required (PR:H). Successful exploitation can affect the confidentiality, integrity and availability of files on the server.

Progress Software · WS_FTP Server

Progress Software WS_FTP Server: Privilege escalation via missing authorization

WS_FTP Server on Windows contains a missing authorization check in its administrative interface. A delegated Host Administrator can exceed their authorized scope, which may allow arbitrary command execution with elevated privileges and full compromise of the underlying server. The attacker needs a valid account with the delegated Host Administrator role, so the risk is mainly from compromised admin accounts, malicious insiders or chaining with another flaw.

Progress Software · WS_FTP Server

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Microsoft Edge (Chromium-based): Privilege escalation via integer overflow

Microsoft Edge (Chromium-based) contains an integer overflow or wraparound (CWE-190) that allows an unauthorized attacker to elevate privileges over a network. According to the CNA record, the CVSS vector requires user interaction (UI:R), so exploitation most likely requires a user to visit a malicious or compromised web page. The CVSS score is 8.8 (CNA) but VulDB rates it 6.3 (Medium), and public technical details are limited.

Microsoft · Edge (Chromium-based)

Research and translation in progress – available shortly.

Microsoft Edge (Chromium-based): Remote code execution via heap buffer overflow

Microsoft Edge (Chromium-based) contains a heap-based buffer overflow that allows an unauthenticated remote attacker to execute code. Exploitation requires that a user visits a malicious or compromised web page, for example through phishing or malicious advertising. Microsoft rates the impact as high for confidentiality, integrity and availability, with a CVSS base score of 8.8.

Microsoft · Edge (Chromium-based)

Microsoft Edge (Chromium-based): Double free leads to remote code execution

A double free vulnerability (CWE-415) in Microsoft Edge (Chromium-based) allows an unauthorized remote attacker to execute code. The CVSS 3.1 base score is 8.8 and the vector requires user interaction, so a victim would typically need to open a malicious web page or link. The NVD analysis is still pending, and the vendor's fixed build must be verified against the MSRC entry.

Microsoft · Edge (Chromium-based)

Microsoft Edge

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Progress WS_FTP Server: Improper authentication with credential exposure

The flaw affects Progress Software WS_FTP Server on Windows in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can access sensitive information, including administrative credentials, without user interaction. The CVSS 10.0 score reflects high impact on confidentiality, integrity and availability, with a changed scope. A compromised server could serve as a starting point for attacks on the wider network.

Progress Software · WS_FTP Server

Research and translation in progress – available shortly.

Langflow Langflow

Research and translation in progress – available shortly.

Langflow Langflow

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Zoho Flow WordPress plugin: Unauthenticated PHP Object Injection

The Zoho Flow plugin for WordPress up to version 2.14.5 contains a PHP Object Injection vulnerability (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to the affected site may manipulate how the site processes data, which can lead to harmful actions on the server, depending on the PHP classes available on the site. No official patch was confirmed at the time of research, and the fixed version is unknown.

Zoho · Flow WordPress plugin

Gunslinger WordPress theme: PHP Object Injection without authentication

The Gunslinger WordPress theme up to and including version 1.11 is affected by an unauthenticated PHP Object Injection flaw (CWE-502) rated CVSS 9.8 critical. An unauthenticated remote attacker can supply crafted serialized data to the website, which may lead to code execution or manipulation of data on the server, depending on the classes available in installed plugins. The theme is typically used for online shops, so internet-facing sites are most at risk.

ThemeREX · Gunslinger

Good Homes WordPress theme: PHP Object Injection without authentication

The Good Homes WordPress theme up to version 1.3.13 is vulnerable to PHP Object Injection through unsafe deserialization of data. An unauthenticated remote attacker can exploit this over the network by sending crafted input to a public website. Depending on the PHP classes available on the site, this can lead to manipulation of data or code execution on the server.

ThemeREX · Good Homes