Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 34 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

    CriticalCVSS 9.1 EPSS 0.73%

    Exploit status: No public exploit known

    Affects: Progress Software WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-90865 Command Injection via FTP Notification Variables in Progress WS_FTP Server

    CriticalCVSS 9.0 EPSS 1.1%

    Exploit status: No public exploit known

    Affects: Progress Software WS_FTP Server

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server

    CriticalCVSS 9.1 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: Progress Software WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-90863 Privilege Escalation via Missing Authorization in WS_FTP Manager

    CriticalCVSS 9.1 EPSS 0.66%

    Exploit status: No public exploit known

    Affects: Progress Software WS_FTP Server

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-84295 Improper Authentication in Progress WS_FTP Server

    CriticalCVSS 10.0 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: Progress Software WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-111732 Out-of-bounds write when parsing AR Vendor Block requests

    CriticalCVSS 9.3 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: RT-Labs AB P-Net

    P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buf...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)

    CriticalCVSS 9.2 EPSS 0.25%

    Exploit status: No public exploit known

    Affects: opentext Advanced Authentication Server

    Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 throug...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).