CVE-2026-90862
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows cou
CVSS
4.3
Média
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 29 de out. de 2026 · Última mod.: 30 de out. de 2026 · CWE-287 · CWE-308
0.2%EPSS · 30 dias0.2%
2026-10-302026-11-06
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-19868——
KEV—50SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability3hCVE-2026-628505.3 MÉD—
——0FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.7hCVE-2026-973676.4 MÉD11.0%
——3A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.6hCVE-2026-964474.2 MÉD7.4%
——2A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.6hCVE-2026-196886.8 MÉD24.4%
——7A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.6hCVE-2026-1109559.8 CRÍ3.9%
——1The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.4h