Threats affecting pkg:bitnami/brotli

A Multi-Factor Authentication (MFA) bypass vulnerability exists in the SSH component of Progress Software WS_FTP Server on Windows. This flaw affects versions prior to 2024.0.6 and 2025.0.3, allowing authenticated users to bypass MFA requirements by exploiting improper association of authentication factors between accounts.

CVE-2026-62014 is a critical unauthenticated PHP Object Injection vulnerability affecting EmojiNation versions up to and including 1.0.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61997 is a critical unauthenticated PHP Object Injection vulnerability affecting Legal Stone versions up to and including 1.2.11. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62004 is a critical unauthenticated PHP Object Injection vulnerability affecting Motorix versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62003 is a critical unauthenticated PHP Object Injection vulnerability affecting Mission software versions up to and including 1.22. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Coinpress versions up to and including 1.0.15. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62006 is a critical unauthenticated PHP Object Injection vulnerability affecting Nuts versions up to and including 1.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62013 is a critical unauthenticated PHP Object Injection vulnerability affecting Edge Decor versions up to and including 2.9. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62002 is a critical unauthenticated PHP Object Injection vulnerability affecting Meals & Wheels versions up to and including 1.1.13. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62010 is a critical unauthenticated PHP Object Injection vulnerability affecting Avventure versions up to and including 1.1.12. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability is classified under CWE-502. No patch or remediation information is currently provided.

CVE-2026-62001 is a critical unauthenticated PHP Object Injection vulnerability affecting Marcell versions up to and including 1.2.14. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Le Truffe versions up to and including 1.1.7. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62009 is a critical unauthenticated PHP Object Injection vulnerability affecting Filmax versions up to and including 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62011 is a critical unauthenticated PHP Object Injection vulnerability affecting Bonbon versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61995 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting YouTube Showcase versions up to and including 4.1.0. This flaw allows attackers to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-62008 is a critical unauthenticated PHP Object Injection vulnerability affecting Orpheus versions up to and including 1.8. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61996 is a SQL Injection vulnerability affecting MLS On The Fly versions up to and including 1.8.1.5. This flaw allows an attacker with low privileges and no user interaction to execute unauthorized SQL queries, potentially leading to high confidentiality impact and limited availability impact. The vulnerability is rated high severity with a CVSS score of 8.5.

An unauthenticated PHP Object Injection vulnerability exists in Muzicon versions up to and including 1.15. This vulnerability allows remote attackers to execute arbitrary code without authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Auction Nudge – Your eBay on Your Site versions up to 8.4.0. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

Blockonomics version 3.11.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. No affected versions beyond 3.11.0 or patch information are provided.