Critical severity threats

CVE-2026-90865 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a CVSS 3.1 score of 9.0, indicating high impact on confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.

CVE-2026-90864 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access or modify files outside their authorized scope, potentially compromising confidentiality, integrity, and availability of the system.

CVE-2026-90863 is a critical vulnerability in Progress Software WS_FTP Server on Windows platforms prior to versions 2024.0.7 and 2025.0.4. It involves missing authorization controls in the administrative interface, allowing a delegated Host Administrator to exceed their authorized permissions. This flaw could lead to arbitrary command execution with elevated privileges, resulting in full compromise of the server.

CVE-2026-84295 is a critical improper authentication vulnerability in Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.6 and 2025.0.3 are affected. This flaw could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

CVE-2026-111732 is a critical out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3 when built with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled. The vulnerability arises because the software parses a data length from a field not defined in the ARVendorBlock and uses it to copy bytes into a fixed-size buffer without proper bounds checking. This can be triggered by a crafted Connect request, potentially causing a crash or arbitrary code execution. The vulnerable option is disabled by default. A fix is available in version 1.0.3.

CVE-2026-112256 is a critical vulnerability in OpenText Advanced Authentication Server that involves acceptance of extraneous untrusted data alongside trusted data. This flaw allows unauthorized access to functionality that is not properly constrained by access control lists (ACLs). It affects versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. The issue has been fixed in versions 6.4.3.9, 6.5.0.11, and 6.6.2.0. The vulnerability has a CVSS v4.0 score of 9.2, indicating a critical severity level.

An insecure permissions vulnerability exists in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730. This flaw allows unauthorized attackers to read flashcards across the user's entire memorization database.

An insecure permission issue in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to trigger automated actions configured by other users.

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed has an insecure access control vulnerability due to an exposed UART debugging interface without authentication or authorization. An attacker with physical access who solders and connects to this interface can gain unauthenticated root shell access to the device.

Simple Contacts Pro versionCode 107 has insecure permissions that allow unauthorized attackers to read and write notes in another user's note database. This vulnerability compromises user data confidentiality and integrity by permitting unauthorized access to personal notes.

Bander Notepad versionCode 12 has insecure permissions that allow unauthorized attackers to read and write notes in another user's note database. This vulnerability could lead to unauthorized data access and modification within the application.

CVE-2026-62131 is a critical vulnerability in Zoho Flow versions up to 2.14.5 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVE-2026-62016 is a critical vulnerability in ThemeREX Gamic versions up to 1.19 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62015 is a critical vulnerability in ThemeREX Gamezone versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise, including complete confidentiality, integrity, and availability loss.

CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVE-2026-62012 is a critical vulnerability in ThemeREX Coinpress versions up to 1.0.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62011 is a critical vulnerability in ThemeREX Bonbon versions up to 1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.