Total
417813 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-96203 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-96199 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-96198 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-96196 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-94423 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. connect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing. Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session. | |||||
| CVE-2026-93680 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | |||||
| CVE-2026-93291 | 2026-10-30 | N/A | 9.4 CRITICAL | ||
| Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code. | |||||
| CVE-2026-93290 | 2026-10-30 | N/A | 5.5 MEDIUM | ||
| Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data. | |||||
| CVE-2026-90872 | 2026-10-30 | N/A | 6.6 MEDIUM | ||
| Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process. | |||||
| CVE-2026-90871 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory. | |||||
| CVE-2026-90870 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation. | |||||
| CVE-2026-90869 | 2026-10-30 | N/A | 7.5 HIGH | ||
| A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows. | |||||
| CVE-2026-90868 | 2026-10-30 | N/A | 9.9 CRITICAL | ||
| An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. | |||||
| CVE-2026-90867 | 2026-10-30 | N/A | 8.1 HIGH | ||
| Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts. | |||||
| CVE-2026-90866 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution. | |||||
| CVE-2026-90865 | 2026-10-30 | N/A | 9.0 CRITICAL | ||
| An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations. | |||||
| CVE-2026-90864 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope. | |||||
| CVE-2026-90863 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server. | |||||
| CVE-2026-90862 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements. | |||||
| CVE-2026-90861 | 2026-10-30 | N/A | 6.6 MEDIUM | ||
| Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server. | |||||