[ Vendor · 8 CVEs ]
Pandora FMS
CVEs affecting Pandora FMS published in the last 30 days, plus any Pandora FMS CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-64948 | 1 Oct 2026 | CVSS 7.1 | Pandora FMSMissing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards. | |
| CVE-2026-64949 | 1 Oct 2026 | CVSS 8.6 | Pandora FMSIncomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS… | |
| CVE-2026-64950 | 1 Oct 2026 | CVSS 8.4 | Pandora FMSMissing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without… | |
| CVE-2026-75786 | 1 Oct 2026 | CVSS 7.2 | Pandora FMSUnsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS… | |
| CVE-2026-34189 | 1 Oct 2026 | CVSS 5.9 | Pandora FMSCross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated… | |
| CVE-2026-34190 | 1 Oct 2026 | CVSS 5.9 | Pandora FMSCross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an… | |
| CVE-2026-64946 | 1 Oct 2026 | CVSS 7.4 | Pandora FMSA chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie… | |
| CVE-2026-64947 | 1 Oct 2026 | CVSS 7.5 | Pandora FMSA chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP… |