CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

EUVD-2026-91037

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

PYSEC-2026-4115 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

CVE-2026-95588

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

EUVD-2026-90855

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

CVE-2026-95588 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

CVE-2026-95588 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

CVE-2026-95588

The AcyMailing SMTP Newsletter WordPress plugin, affecting versions

EUVD-2026-90813

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...

CVE-2026-66246 HCL iControl is affected by multiple security vulnerabilities

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...

WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Oly Hossen in WordPress Plugin AcyMailing SMTP Newsletter versions = 11.0.5...

WordPress BackupSheep WordPress Backup Plugin plugin <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability

Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin BackupSheep WordPress Backup Plugin versions = 1.8...

WordPress Cache Enabler plugin < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion vulnerability

Unauthenticated Arbitrary File and Directory Deletion vulnerability discovered by Jakub Herman in WordPress Plugin Cache Enabler versions 1.8.17...

BIT-KIBANA-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

BIT-KIBANA-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-34190 CSRF in Alert Command Deletion

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...