Threats affecting pkg:generic/osquery

CVE-2026-62016 is a critical unauthenticated PHP Object Injection vulnerability affecting Gamic versions up to and including 1.19. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Zimbra Classic UI is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the From email header during HTML reply composition. An attacker can send a crafted email with a malicious From header containing JavaScript. When the victim opens the message and replies in HTML mode with reply headers disabled, the payload executes in the browser. This can lead to session theft or unauthorized actions. The issue is fixed in version 10.1.21.

CVE-2026-88077 is an integer overflow or wraparound vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

An improper authentication vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.6 and 2025.0.3. This flaw could allow an unauthenticated remote attacker to gain access to sensitive information, including administrative credentials. The vulnerability has a critical severity rating with a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.

A path traversal vulnerability exists in the Ad Hoc Transfer component of Progress Software WS_FTP Server on Windows versions prior to 2024.0.6 and 2025.0.3. This flaw allows an authenticated user to access files outside the intended directories, potentially exposing sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-62017 is a critical unauthenticated PHP Object Injection vulnerability affecting Good Homes versions up to and including 1.3.13. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A double free vulnerability in the Chromium-based Microsoft Edge browser allows an unauthorized attacker to execute code remotely over a network. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity score of 8.8 but no known exploits in the wild have been reported as of the publication date.

A heap-based buffer overflow vulnerability exists in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw has a high severity rating with a CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. No affected versions or patch information are currently provided.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information. This occurs due to improper sanitization of secrets during flow and project exports. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

CVE-2026-62131 is a critical unauthenticated PHP Object Injection vulnerability affecting Zoho Flow versions up to and including 2.14.5. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Zimbra email software has a stored cross-site scripting (XSS) vulnerability via the Content-Location MIME header in email attachments. An attacker can craft an email with a malicious Content-Location header containing a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser. This vulnerability was fixed in Zimbra version 10.1.21.

A Multi-Factor Authentication (MFA) bypass vulnerability exists in the SSH component of Progress Software WS_FTP Server on Windows. This flaw affects versions prior to 2024.0.6 and 2025.0.3, allowing authenticated users to bypass MFA requirements by exploiting improper association of authentication factors between accounts.

CVE-2026-62014 is a critical unauthenticated PHP Object Injection vulnerability affecting EmojiNation versions up to and including 1.0.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61997 is a critical unauthenticated PHP Object Injection vulnerability affecting Legal Stone versions up to and including 1.2.11. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62004 is a critical unauthenticated PHP Object Injection vulnerability affecting Motorix versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62003 is a critical unauthenticated PHP Object Injection vulnerability affecting Mission software versions up to and including 1.22. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Coinpress versions up to and including 1.0.15. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62006 is a critical unauthenticated PHP Object Injection vulnerability affecting Nuts versions up to and including 1.12. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62013 is a critical unauthenticated PHP Object Injection vulnerability affecting Edge Decor versions up to and including 2.9. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62002 is a critical unauthenticated PHP Object Injection vulnerability affecting Meals & Wheels versions up to and including 1.1.13. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.