CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28173 WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-28173

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-28173

The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...

EUVD-2026-57956

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716

CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...

EUVD-2026-57930

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-73616

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

UBUNTU-CVE-2026-73621

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

CVE-2026-73616 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

EUVD-2026-57820

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

CVE-2026-73616

Technical details (affected products, vulnerable components, root cause, remediation) are not publicly provided in the supplied documents. Monitor for updates from OpenRemote advisories and CVE listings for concrete technical specifics and fixes.

CVE-2026-73613 filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

CVE-2026-73613 filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

EUVD-2026-57817

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

CVE-2026-73613

Technical details are not publicly available in the provided documents. Monitor for updates.

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied...

CVE-2026-0291

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...