Threats affecting pkg:bitnami/brotli

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information. This occurs due to improper sanitization of secrets during flow and project exports. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

CVE-2026-62131 is a critical unauthenticated PHP Object Injection vulnerability affecting Zoho Flow versions up to and including 2.14.5. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Zimbra email software has a stored cross-site scripting (XSS) vulnerability via the Content-Location MIME header in email attachments. An attacker can craft an email with a malicious Content-Location header containing a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser. This vulnerability was fixed in Zimbra version 10.1.21.

A Multi-Factor Authentication (MFA) bypass vulnerability exists in the SSH component of Progress Software WS_FTP Server on Windows. This flaw affects versions prior to 2024.0.6 and 2025.0.3, allowing authenticated users to bypass MFA requirements by exploiting improper association of authentication factors between accounts.

CVE-2026-62014 is a critical unauthenticated PHP Object Injection vulnerability affecting EmojiNation versions up to and including 1.0.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61997 is a critical unauthenticated PHP Object Injection vulnerability affecting Legal Stone versions up to and including 1.2.11. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62004 is a critical unauthenticated PHP Object Injection vulnerability affecting Motorix versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62003 is a critical unauthenticated PHP Object Injection vulnerability affecting Mission software versions up to and including 1.22. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Coinpress versions up to and including 1.0.15. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62006 is a critical unauthenticated PHP Object Injection vulnerability affecting Nuts versions up to and including 1.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62013 is a critical unauthenticated PHP Object Injection vulnerability affecting Edge Decor versions up to and including 2.9. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62002 is a critical unauthenticated PHP Object Injection vulnerability affecting Meals & Wheels versions up to and including 1.1.13. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62010 is a critical unauthenticated PHP Object Injection vulnerability affecting Avventure versions up to and including 1.1.12. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability is classified under CWE-502. No patch or remediation information is currently provided.

CVE-2026-62001 is a critical unauthenticated PHP Object Injection vulnerability affecting Marcell versions up to and including 1.2.14. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Le Truffe versions up to and including 1.1.7. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62009 is a critical unauthenticated PHP Object Injection vulnerability affecting Filmax versions up to and including 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62011 is a critical unauthenticated PHP Object Injection vulnerability affecting Bonbon versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61995 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting YouTube Showcase versions up to and including 4.1.0. This flaw allows attackers to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-62008 is a critical unauthenticated PHP Object Injection vulnerability affecting Orpheus versions up to and including 1.8. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61996 is a SQL Injection vulnerability affecting MLS On The Fly versions up to and including 1.8.1.5. This flaw allows an attacker with low privileges and no user interaction to execute unauthorized SQL queries, potentially leading to high confidentiality impact and limited availability impact. The vulnerability is rated high severity with a CVSS score of 8.5.