Threats affecting pkg:generic/osquery

ProjectMAXS MAXS Main version 0.5.19 (versionCode 19) contains insecure permissions that allow unauthorized attackers to arbitrarily manipulate the app's MAXS command and transport mechanism. This vulnerability could enable attackers to interfere with the app's internal communication or control flows.

A heap-based buffer overflow vulnerability exists in the Chromium-based Microsoft Edge browser. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands, potentially leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.9.

Szafir and Szafir Weryfikująca are affected by an XML External Entity (XXE) injection vulnerability (CVE-2026-93570). This flaw allows an attacker to craft XML files with external DTD references, enabling the XML parser to process external entities and potentially read arbitrary files from the victim's filesystem. The vulnerability has been fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported and remains unpatched.

Szafir contains a path traversal vulnerability in the filename handling of uploaded files. An attacker capable of intercepting and redirecting update requests can craft a malicious XML file that is saved to an arbitrary location chosen by the attacker. This vulnerability was addressed in Szafir version 2.0 build 708.

A path traversal vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow a delegated Host Administrator to access or modify files outside their authorized scope, potentially leading to full system compromise.

A path traversal vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw allows a delegated Host Administrator to access file system locations beyond their authorized scope, which could lead to remote code execution.

A missing authorization vulnerability exists in the administrative interface of Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw allows a delegated Host Administrator to perform actions beyond their authorized scope, potentially leading to arbitrary command execution with elevated privileges and full compromise of the server.

A resource management flaw exists in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows, where backend receiver sessions are not properly released. This issue affects versions prior to 2024.0.7 and 2025.0.4 and can cause server resource exhaustion leading to service degradation.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose user passwords in clear text to other administrators. This vulnerability could allow an administrator with limited privileges to obtain passwords and potentially escalate their access on the server.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by allocating resources without limits or throttling. This can exhaust system resources, leading to service disruption.

CVE-2026-90871 is a directory traversal vulnerability in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. It allows an unauthenticated attacker to access or modify files outside the intended restricted directory.

An improper authentication vulnerability exists in the Web Transfer Module of Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.7 and 2025.0.4 are affected. This flaw allows an attacker who has obtained a user's password to access certain files associated with that account without completing multi-factor authentication.

An improper access control vulnerability exists in the Web Admin console of Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.7 and 2025.0.4 are affected. This flaw could allow remote unauthenticated attackers to access administrative functionality.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in the Manager web console of Progress Software WS_FTP Server on Windows allows an authenticated Manager administrator to execute arbitrary commands with the privileges of the IIS worker process. This issue affects versions prior to 2024.0.7 and 2025.0.4. The flaw is due to improper neutralization of directives in dynamically evaluated code.

A vulnerability in Progress Software WS_FTP Server on Windows allows a remote attacker who knows a valid account's enrolled SSH public key to terminate the shared SSH service. This affects versions prior to 2024.0.7 and 2025.0.4. The vulnerability has a high severity score and impacts availability without affecting confidentiality or integrity.

A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. The flaw involves accessing a resource using an incompatible type, potentially leading to privilege escalation. The vulnerability has a medium severity with a CVSS score of 5.4. No affected versions or patch information are currently provided.

A vulnerability in Microsoft Edge (Chromium-based) involves improper verification of cryptographic signatures, which could allow an unauthorized attacker to perform spoofing attacks over a network. The flaw is identified as CVE-2026-88078 and has a medium severity rating with a CVSS score of 4.3. No specific affected versions or patches are currently detailed.

A use-after-free vulnerability exists in the Chromium-based Microsoft Edge browser that allows an authorized attacker to elevate privileges over a network. The flaw involves improper handling of memory, which can lead to privilege escalation without user interaction.