Threats affecting pkg:generic/osquery

A path traversal vulnerability exists in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows versions prior to 2024.0.6 and 2025.0.3. This flaw allows an authenticated user to access files outside the intended directories, potentially exposing sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-62017 is a critical unauthenticated PHP Object Injection vulnerability affecting Good Homes versions up to and including 1.3.13. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A double free vulnerability in the Chromium-based Microsoft Edge browser allows an unauthorized attacker to execute code remotely over a network. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity score of 8.8 but no known exploits in the wild have been reported as of the publication date.

A heap-based buffer overflow vulnerability exists in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw has a high severity rating with a CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. No affected versions or patch information are currently provided.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information. This occurs due to improper sanitization of secrets during flow and project exports. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

CVE-2026-62131 is a critical unauthenticated PHP Object Injection vulnerability affecting Zoho Flow versions up to and including 2.14.5. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Zimbra email software has a stored cross-site scripting (XSS) vulnerability via the Content-Location MIME header in email attachments. An attacker can craft an email with a malicious Content-Location header containing a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser. This vulnerability was fixed in Zimbra version 10.1.21.

A Multi-Factor Authentication (MFA) bypass vulnerability exists in the SSH component of Progress Software WS_FTP Server on Windows. This flaw affects versions prior to 2024.0.6 and 2025.0.3, allowing authenticated users to bypass MFA requirements by exploiting improper association of authentication factors between accounts.

CVE-2026-62014 is a critical unauthenticated PHP Object Injection vulnerability affecting EmojiNation versions up to and including 1.0.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61997 is a critical unauthenticated PHP Object Injection vulnerability affecting Legal Stone versions up to and including 1.2.11. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62004 is a critical unauthenticated PHP Object Injection vulnerability affecting Motorix versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62003 is a critical unauthenticated PHP Object Injection vulnerability affecting Mission software versions up to and including 1.22. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Coinpress versions up to and including 1.0.15. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62006 is a critical unauthenticated PHP Object Injection vulnerability affecting Nuts versions up to and including 1.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62013 is a critical unauthenticated PHP Object Injection vulnerability affecting Edge Decor versions up to and including 2.9. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62002 is a critical unauthenticated PHP Object Injection vulnerability affecting Meals & Wheels versions up to and including 1.1.13. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62010 is a critical unauthenticated PHP Object Injection vulnerability affecting Avventure versions up to and including 1.1.12. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability is classified under CWE-502. No patch or remediation information is currently provided.

CVE-2026-62001 is a critical unauthenticated PHP Object Injection vulnerability affecting Marcell versions up to and including 1.2.14. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Le Truffe versions up to and including 1.1.7. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62009 is a critical unauthenticated PHP Object Injection vulnerability affecting Filmax versions up to and including 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.