EUVD-2026-62918

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76353

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76353 Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76353

CVE-2026-76353 is a path traversal vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that knowledge bundle delta processing does not restrict removal paths to the staging directory, and the endpoint does not enforce the expected authorization...

CVE-2026-46343

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...

EUVD-2026-62553

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...

CVE-2026-46343

In Wazuh versions 4.0.0 through 4.14.5 and 5.0.0-beta1, the end_receiving_file() method in framework/wazuh/core/cluster/common.py passes an attacker-controlled filename to os.path.join without canonicalization or path confinement. A cluster-authenticated node can send a syn_i_w_m_e request with a...

CVE-2026-46343 Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...

CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-75949

J-BusinessDirectory (Joomla extension by cmsjunkie.com) versions below 6.2.3 accept a client-controlled _path_type parameter without path-containment enforcement or a strong extension check, enabling arbitrary file upload/deletion and CSRF via missing tokens. Exploitation details are not provided...

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

CVE-2026-19942

The Atarim WordPress plugin (≤5.1.1) allows authenticated author-level attackers to delete arbitrary server files. The root cause is insufficient file path validation in AVCF_Abilities_Media::register's replace-media-file execute_callback. Attackers first use atarim/update-post-field to set _wp_a...

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

PT-2026-78780

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can delete arbitrary...

CVE-2026-50186

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

EUVD-2026-62202

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...

CVE-2026-66635

WordPress Slider by 10Web plugin (versions ≤ 1.2.62) contains a CSRF vulnerability allowing an unauthenticated attacker to trick an authenticated user into deleting arbitrary files on the server. The flaw stems from missing CSRF protection on file-deletion actions. Impact is availability-focused ...