Threats affecting pkg:generic/osquery

A resource management flaw exists in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows, where backend receiver sessions are not properly released. This issue affects versions prior to 2024.0.7 and 2025.0.4 and can cause server resource exhaustion leading to service degradation.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose user passwords in clear text to other administrators. This vulnerability could allow an administrator with limited privileges to obtain passwords and potentially escalate their access on the server.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by allocating resources without limits or throttling. This can exhaust system resources, leading to service disruption.

CVE-2026-90871 is a directory traversal vulnerability in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. It allows an unauthenticated attacker to access or modify files outside the intended restricted directory.

An improper authentication vulnerability exists in the Web Transfer Module of Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.7 and 2025.0.4 are affected. This flaw allows an attacker who has obtained a user's password to access certain files associated with that account without completing multi-factor authentication.

An improper access control vulnerability exists in the Web Admin console of Progress Software WS_FTP Server on Windows. Versions prior to 2024.0.7 and 2025.0.4 are affected. This flaw could allow remote unauthenticated attackers to access administrative functionality.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. The vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in the Manager web console of Progress Software WS_FTP Server on Windows allows an authenticated Manager administrator to execute arbitrary commands with the privileges of the IIS worker process. This issue affects versions prior to 2024.0.7 and 2025.0.4. The flaw is due to improper neutralization of directives in dynamically evaluated code.

A vulnerability in Progress Software WS_FTP Server on Windows allows a remote attacker who knows a valid account's enrolled SSH public key to terminate the shared SSH service. This affects versions prior to 2024.0.7 and 2025.0.4. The vulnerability has a high severity score and impacts availability without affecting confidentiality or integrity.

A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. The flaw involves accessing a resource using an incompatible type, potentially leading to privilege escalation. The vulnerability has a medium severity with a CVSS score of 5.4. No affected versions or patch information are currently provided.

A vulnerability in Microsoft Edge (Chromium-based) involves improper verification of cryptographic signatures, which could allow an unauthorized attacker to perform spoofing attacks over a network. The flaw is identified as CVE-2026-88078 and has a medium severity rating with a CVSS score of 4.3. No specific affected versions or patches are currently detailed.

A use-after-free vulnerability exists in the Chromium-based Microsoft Edge browser that allows an authorized attacker to elevate privileges over a network. The flaw involves improper handling of memory, which can lead to privilege escalation without user interaction.

CVE-2026-62015 is a critical unauthenticated PHP Object Injection vulnerability affecting Gamezone versions up to 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to overwrite arbitrary files. This occurs due to improper limitation of pathname to a restricted directory, enabling path traversal attacks. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-62018 is an unauthenticated PHP Object Injection vulnerability affecting Gunslinger versions up to and including 1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network due to incorrect authorization. The issue does not impact confidentiality or availability but may allow limited integrity loss. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-62016 is a critical unauthenticated PHP Object Injection vulnerability affecting Gamic versions up to and including 1.19. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Zimbra Classic UI is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the From email header during HTML reply composition. An attacker can send a crafted email with a malicious From header containing JavaScript. When the victim opens the message and replies in HTML mode with reply headers disabled, the payload executes in the browser. This can lead to session theft or unauthorized actions. The issue is fixed in version 10.1.21.

CVE-2026-88077 is an integer overflow or wraparound vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

An improper authentication vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.6 and 2025.0.3. This flaw could allow an unauthenticated remote attacker to gain access to sensitive information, including administrative credentials. The vulnerability has a critical severity rating with a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.