PT-2026-37031

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload icons function workflow using a user-controlled upload path mfn-icon-upload in a filesystem move operation without constraining it to the uploads directory...

WordPress Betheme theme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion vulnerability

Authenticated Contributor+ Arbitrary File Deletion vulnerability discovered by ? in WordPress Theme Betheme versions = 28.4...

Gen Digital Norton Secure VPN 安全漏洞

Gen Digital Norton Secure VPN is a virtual private network service provided by the American company Gen Digital. There is a security vulnerability in Gen Digital Norton Secure VPN, which stems from permission escalation during the installation process through the Microsoft Store. Low-privilege...

VulnCheck KEV: CVE-2024-4346

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to...

Tenable Nessus < 10.11.4 / 10.12.0 Arbitrary File Deletion (TNS-2026-13)

According to its self-reported version, the Tenable Nessus application running on the remote Windows host is prior to 10.11.4 or 10.12.0. It is, therefore, affected by an arbitrary file deletion vulnerability as referenced in the TNS-2026-13 advisory. - A vulnerability exists in Nessus on Windows...

Important: flatpak

Issue Overview: A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, giving apps access to...

Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2026-1601)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1601 advisory. A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitra...

CVE-2018-25308 BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion

BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the fieldhiddenfile and fielddeleteimg parameters during profile editing to unlink...

The vulnerability of the application management tools and Flatpak environments relates to incorrect path name restrictions, allowing attackers to gain access to delete arbitrary files.

The vulnerability of the application management tool and Flatpak environments is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a remote attacker to gain access to delete any files they desire...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options bsc1261769. CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation bsc1261770. Patch Instructions: To install this SUSE upda...

CVE-2026-2028 Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxiremovecustomimagesize' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-leve...

Tenable Nessus Agent < 11.1.3 Arbitrary File Deletion (TNS-2026-12)

According to its self-reported version, the Tenable Nessus Agent running on the remote Windows host is prior to 11.1.3. It is, therefore, affected by an arbitrary file deletion vulnerability as referenced in the TNS-2026-12 advisory. - A vulnerability exists in Nessus Agent on Windows where an...

CVE-2026-33694

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...

[R1] Nessus Versions 10.11.4 and 10.12.0 Fixes Arbitrary File Deletion

R1 Nessus Versions 10.11.4 and 10.12.0 Fixes Arbitrary File Deletion Jason Schavel Thu, 04/23/2026 - 14:30 A vulnerability has been identified in Nessus on Windows where an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition...

[R1] Nessus Agent Version 11.1.3 Fixes Arbitrary File Deletion

R1 Nessus Agent Version 11.1.3 Fixes Arbitrary File Deletion Jason Schavel Thu, 04/23/2026 - 14:10 A vulnerability has been identified in Nessus Agent on Windows where an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition...

CVE-2026-33694 Junction File Manipulation

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...

CVE-2026-33694

CVE-2026-33694 describes a junction file manipulation vulnerability where an attacker can create a junction to delete arbitrary files with SYSTEM privileges, potentially enabling arbitrary code execution at SYSTEM level. The description explicitly notes elevated privileges and the possibility of ...

CVE-2026-33694 Junction File Manipulation

This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...

SUSE SLES15 Security Update : flatpak (SUSE-SU-2026:1541-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1541-1 advisory. - CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host file access and...

WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Link Library versions = 7.8.8...