CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946

The Pandora FMS monitoring platform is affected by a chained vulnerability involving CSRF and unrestricted SVG file upload within the File Manager module . This flaw allows for stored Cross-Site Scripting (XSS) , which can be leveraged to exfiltrate session cookies and perform administrator accou...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CLEANSTART-2024-ML93442 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89...

CLEANSTART-2025-IL34570 arbitrary file deletion vulnerability in Gitea v1

Security vulnerability affects the gitea package. An arbitrary file deletion vulnerability in Gitea v1...

CLEANSTART-2024-PX18765 Use after free in File System API in Google Chrome prior to 92

Security vulnerability affects the chromium package. Use after free in File System API in Google Chrome prior to 92...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Arbitrary File/Directory Deletion . The root cause stems from a lack of capability checks in the super_save_form AJAX handler, allowing Subscriber-level authenticated users...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

EUVD-2026-90563

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CLEANSTART-2024-EO25868 Use after free in File Manager in Google Chrome on Chrome OS prior to 98

Security vulnerability affects the chromium package. Use after free in File Manager in Google Chrome on Chrome OS prior to 98...

CLEANSTART-2024-FQ58069 Use after free in File Manager in Google Chrome prior to 101

Security vulnerability affects the chromium package. Use after free in File Manager in Google Chrome prior to 101...

CLEANSTART-2024-AM48749 Use after free in File System API in Google Chrome prior to 101

Security vulnerability affects the chromium package. Use after free in File System API in Google Chrome prior to 101...

CLEANSTART-2024-MV82108 Insufficient policy enforcement in File System API in Google Chrome prior to 102

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome prior to 102...

CLEANSTART-2024-SW99198 Insufficient policy enforcement in File System API in Google Chrome prior to 102

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome prior to 102...

CLEANSTART-2024-DN54132 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103...

CLEANSTART-2024-WS76335 Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103

Security vulnerability affects the chromium package. Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103...

WordPress Zella Theme theme < 2.6.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Theme Zella Theme versions 2.6.3...