KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying…
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command…
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication…
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker…
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From…
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-90862 Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to… |
Pozostałe |
CVSS 4,3EPSS 0,22 % | ||
| CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to… |
Wysoki priorytet |
CVSS 9,1EPSS 0,66 % | ||
| CVE-2026-90864 A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files… |
Wysoki priorytet |
CVSS 9,1EPSS 0,48 % | ||
| CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges… |
Wysoki priorytet |
CVSS 9,0EPSS 1,14 % | ||
| CVE-2026-90866 A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside… |
Wysoki priorytet |
CVSS 9,1EPSS 0,73 % | ||
| CVE-2026-90867 Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote… |
Monitoruj |
CVSS 8,1EPSS 0,4 % | ||
| CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain… |
Wysoki priorytet |
CVSS 9,9EPSS 1,49 % | ||
| CVE-2026-88090 Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. |
Pozostałe |
CVSS 5,4EPSS 0,32 % | ||
| CVE-2026-88078 Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
Pozostałe |
CVSS 4,3EPSS 0,3 % | ||
| CVE-2026-88077 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. |
Monitoruj |
CVSS 8,8EPSS 0,64 % | ||
| CVE-2026-85890 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
Monitoruj |
CVSS 8,8EPSS 0,59 % | ||
| CVE-2026-85897 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
Monitoruj |
CVSS 8,8EPSS 0,59 % | ||
| CVE-2026-85899 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network. |
Monitoruj |
CVSS 8,1EPSS 0,64 % | ||
| CVE-2026-85330 Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
Pozostałe |
CVSS 4,3EPSS 0,35 % | ||
| CVE-2026-84294 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to… |
Monitoruj |
CVSS 7,7EPSS 0,35 % | ||
| CVE-2026-84295 Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive… |
Wysoki priorytet |
CVSS 10,0EPSS 0,55 % | ||
| CVE-2026-84296 Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to… |
Pozostałe |
CVSS 6,8EPSS 0,34 % | ||
| CVE-2026-77817 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports. |
Pozostałe |
CVSS 6,5EPSS 0,34 % | ||
| CVE-2026-77819 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory. |
Pozostałe |
CVSS 6,5EPSS 0,37 % | ||
| CVE-2026-66911 Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker… |
PozostałeCERT.pl |
CVSS 5,3EPSS 0,54 % | ||
| CVE-2026-66912 Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value,… |
PozostałeCERT.pl |
CVSS 5,3EPSS 0,47 % | ||
| CVE-2026-62013 Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. |
Wysoki priorytet |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2026-62014 Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2026-62015 Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2026-62016 Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 8.11.2026, 07:32 UTC – 8.11.2026, 09:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.