CVE-2026-6262 Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the uploadicons function workflow using a user-controlled upload path mfn-icon-upload in a filesystem move operation without constraining it to the uploads directory. Th...

CVE-2026-6262 Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the uploadicons function workflow using a user-controlled upload path mfn-icon-upload in a filesystem move operation without constraining it to the uploads directory. Th...

PT-2026-37031

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload icons function workflow using a user-controlled upload path mfn-icon-upload in a filesystem move operation without constraining it to the uploads directory...

WordPress plugin Betheme 路径遍历漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

WordPress Betheme theme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion vulnerability

Authenticated Contributor+ Arbitrary File Deletion vulnerability discovered by ? in WordPress Theme Betheme versions = 28.4...

Gen Digital Norton Secure VPN 安全漏洞

Gen Digital Norton Secure VPN is a virtual private network service provided by the American company Gen Digital. There is a security vulnerability in Gen Digital Norton Secure VPN, which stems from permission escalation during the installation process through the Microsoft Store. Low-privilege...

VulnCheck KEV: CVE-2024-4346

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to...

Tenable Nessus < 10.11.4 / 10.12.0 Arbitrary File Deletion (TNS-2026-13)

According to its self-reported version, the Tenable Nessus application running on the remote Windows host is prior to 10.11.4 or 10.12.0. It is, therefore, affected by an arbitrary file deletion vulnerability as referenced in the TNS-2026-13 advisory. - A vulnerability exists in Nessus on Windows...

The vulnerability of the application management tools and Flatpak environments relates to incorrect path name restrictions, allowing attackers to gain access to delete arbitrary files.

The vulnerability of the application management tool and Flatpak environments is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain access to delete any files they desire...

Tenable Nessus Agent < 11.1.3 Arbitrary File Deletion (TNS-2026-12)

According to its self-reported version, the Tenable Nessus Agent running on the remote Windows host is prior to 11.1.3. It is, therefore, affected by an arbitrary file deletion vulnerability as referenced in the TNS-2026-12 advisory. - A vulnerability exists in Nessus Agent on Windows where an...

[R1] Nessus Versions 10.11.4 and 10.12.0 Fixes Arbitrary File Deletion

R1 Nessus Versions 10.11.4 and 10.12.0 Fixes Arbitrary File Deletion Jason Schavel Thu, 04/23/2026 - 14:30 A vulnerability has been identified in Nessus on Windows where an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition...

[R1] Nessus Agent Version 11.1.3 Fixes Arbitrary File Deletion

R1 Nessus Agent Version 11.1.3 Fixes Arbitrary File Deletion Jason Schavel Thu, 04/23/2026 - 14:10 A vulnerability has been identified in Nessus Agent on Windows where an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition...

CVE-2026-33694 Junction File Manipulation

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...

CVE-2026-33694 Junction File Manipulation

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...

CVE-2026-33694

CVE-2026-33694 describes a junction file manipulation vulnerability where an attacker can create a junction to delete arbitrary files with SYSTEM privileges, potentially enabling arbitrary code execution at SYSTEM level. The description explicitly notes elevated privileges and the possibility of ...

WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Link Library versions = 7.8.8...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host file access and code execution in the host context bsc1261769. CVE-2026-34079: improper removal of outdated cache files allows for...

CVE-2026-41058 AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink of arbitrary files via ../../ sequences in the GET parameter. Commit...

CVE-2026-6832

CVE-2026-6832 affects Nesquena Hermes WebUI. The vulnerability resides in the /api/session/delete endpoint where an unvalidated session_id enables an authenticated attacker to bypass the SESSION_DIR boundary using absolute or path traversal payloads, enabling deletion of writable JSON files outsi...

CVE-2026-6832 Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the sessionid parameter. Attackers can exploit unvalidate...