Critical severity threats

A path traversal vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow a delegated Host Administrator to access or modify files outside their authorized scope, potentially leading to full system compromise.

A path traversal vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw allows a delegated Host Administrator to access file system locations beyond their authorized scope, which could lead to remote code execution.

A missing authorization vulnerability exists in the administrative interface of Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw allows a delegated Host Administrator to perform actions beyond their authorized scope, potentially leading to arbitrary command execution with elevated privileges and full compromise of the server.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62015 is a critical unauthenticated PHP Object Injection vulnerability affecting Gamezone versions up to 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62018 is an unauthenticated PHP Object Injection vulnerability affecting Gunslinger versions up to and including 1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62016 is a critical unauthenticated PHP Object Injection vulnerability affecting Gamic versions up to and including 1.19. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An improper authentication vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.6 and 2025.0.3. This flaw could allow an unauthenticated remote attacker to gain access to sensitive information, including administrative credentials. The vulnerability has a critical severity rating with a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62017 is a critical unauthenticated PHP Object Injection vulnerability affecting Good Homes versions up to and including 1.3.13. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62131 is a critical unauthenticated PHP Object Injection vulnerability affecting Zoho Flow versions up to and including 2.14.5. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62014 is a critical unauthenticated PHP Object Injection vulnerability affecting EmojiNation versions up to and including 1.0.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61997 is a critical unauthenticated PHP Object Injection vulnerability affecting Legal Stone versions up to and including 1.2.11. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62004 is a critical unauthenticated PHP Object Injection vulnerability affecting Motorix versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62003 is a critical unauthenticated PHP Object Injection vulnerability affecting Mission software versions up to and including 1.22. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Coinpress versions up to and including 1.0.15. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62006 is a critical unauthenticated PHP Object Injection vulnerability affecting Nuts versions up to and including 1.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62013 is a critical unauthenticated PHP Object Injection vulnerability affecting Edge Decor versions up to and including 2.9. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62002 is a critical unauthenticated PHP Object Injection vulnerability affecting Meals & Wheels versions up to and including 1.1.13. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62010 is a critical unauthenticated PHP Object Injection vulnerability affecting Avventure versions up to and including 1.1.12. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability is classified under CWE-502. No patch or remediation information is currently provided.

CVE-2026-62001 is a critical unauthenticated PHP Object Injection vulnerability affecting Marcell versions up to and including 1.2.14. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.