UpHeron
All posts

Critical vulnerabilities

16 critical vulnerabilities in 5 servers and applications

16 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: WS_FTP Server (6), Remote code execution in servers and applications, curl (7) and more.

  • 16 critical

WS_FTP Server

6 vulnerabilities · Servers and applications · most fixed in 2024.0.7, 2025.0.4

  1. 10.0Improper Authentication in Progress WS_FTP ServerFixed in 2024.0.6, 2025.0.3CVE-2026-84295
  2. 9.9OS Command Injection in Progress WS_FTP ServerFixed in 2024.0.7, 2025.0.4CVE-2026-90868
  3. 9.1Virtual Folder Path Confinement Bypass in Progress WS_FTP ServerFixed in 2024.0.7, 2025.0.4CVE-2026-90866
  4. 9.1Host Administrator Path Containment Bypass in Progress WS_FTP ServerFixed in 2024.0.7, 2025.0.4CVE-2026-90864
  5. 9.1Privilege Escalation via Missing Authorization in WS_FTP ManagerFixed in 2024.0.7, 2025.0.4CVE-2026-90863
  6. 9.0Command Injection via FTP Notification Variables in Progress WS_FTP ServerFixed in 2024.0.7, 2025.0.4CVE-2026-90865

Remote code execution in servers and applications

2 vulnerabilities

  1. 9.4Frappe FrameworkFrappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File UploadFixed in 15.121.0, 16.34.0CVE-2026-119145
  2. 9.4Wing FTP ServerPath Traversal in Wing WFTP Server leading to Remote Code ExecutionFixed in 8.2.6CVE-2026-105420

curl

7 vulnerabilities · Servers and applications

  1. 9.1Authorization: Negotiate sent to foreign originUp to 8.22.0CVE-2026-94265
  2. 9.1FTP wildcard write callback mixupUp to 8.22.0CVE-2026-92388
  3. 9.1wolfSSL public-key pinning bypassUp to 8.22.0CVE-2026-87866
  4. 9.1cross-origin reuse of a Negotiate connectionUp to 8.22.0CVE-2026-87861
  5. 9.1leaking host credentials to HTTP proxyUp to 8.22.0CVE-2026-86414
Show 2 more
  1. 9.1Negotiate credentials sent to redirected originUp to 8.22.0CVE-2026-86413
  2. 9.1FTP connection reuse inherits client-certificateUp to 8.21.0CVE-2026-86411

Other vulnerabilities in servers and applications

1 vulnerability

  1. 9.8Splunk EnterpriseSecurity Hardening in Splunk Enterprise - October 2026Fixed in 10.2.8, 10.4.4CVE-2026-76301

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.