CVE-2026-78284

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...

CVE-2026-75464

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...

CVE-2026-32477

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-28171

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

EUVD-2026-64801

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32477 WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-28171 WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

CVE-2026-28171

CVE-2026-28171 is an unauthenticated arbitrary file deletion vulnerability in the WooCommerce File Approval WordPress plugin, affecting versions 10.7 and earlier . An unauthenticated remote attacker can delete arbitrary files on the server, leading to a high availability impact with changed scope...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

EUVD-2026-65146

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...

CVE-2026-75464

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...

CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint. The endpoint accepts an unvalidated path parameter that is passed directly to os.RemoveAll, allowing an authenticated admin attacker to supply absolute filesystem paths and r...

CVE-2026-60084 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

EUVD-2026-64269

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-45099

Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...

CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

EUVD-2026-63588

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Summary HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php reads file paths from the clear request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record. An authenticated user with Update...