PF
Vendor
Pandora FMS
26
CVEs
0
On KEV
8
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-75786 | PF Pandora FMS Pandora FMS | 7.2 | Oct 1 | SQL Injection in Grafana Integration Endpoint (query.php) |
| CVE-2026-64950 | PF Pandora FMS Pandora FMS | 8.4 | Oct 1 | Stored Cross-Site Scripting via Directory Name in File Manager Create Directory |
| CVE-2026-64949 | PF Pandora FMS Pandora FMS | 8.6 | Oct 1 | Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager |
| CVE-2026-64948 | PF Pandora FMS Pandora FMS | 7.1 | Oct 1 | Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure |
| CVE-2026-64947 | PF Pandora FMS Pandora FMS | 7.5 | Oct 1 | CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager |
| CVE-2026-64946 | PF Pandora FMS Pandora FMS | 7.4 | Oct 1 | CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager |
| CVE-2026-34190 | PF Pandora FMS Pandora FMS | 5.9 | Oct 1 | CSRF in Alert Command Deletion |
| CVE-2026-34189 | PF Pandora FMS Pandora FMS | 5.9 | Oct 1 | CSRF in Event Response Deletion |
| CVE-2026-34187 | PF Pandora FMS Pandora FMS | 9.8 | May 12 | SQL Injection in Graph Container Parameter |
| CVE-2026-30810 | PF Pandora FMS Pandora FMS | 8.8 | May 12 | Server-Side Request Forgery in API Checker leads to Privilege Escalation |
| CVE-2026-30808 | PF Pandora FMS Pandora FMS | 8.1 | May 12 | Session Fixation in Authentication leads to Session Hijacking |
| CVE-2026-30807 | PF Pandora FMS Pandora FMS | 8.8 | May 12 | Cross-Site Request Forgery on Extension Pages |
| CVE-2026-30805 | PF Pandora FMS Pandora FMS | 9.1 | May 12 | Insecure Default Initialization in API Authentication leads to Authentication Bypass |
| CVE-2026-34188 | PF Pandora FMS Pandora FMS | 7.2 | Apr 13 | OS Command Injection in Event Response Execution |
| CVE-2026-34186 | PF Pandora FMS Pandora FMS | 8.8 | Apr 13 | SQL Injection in Custom Fields leads to Database Compromise |
| CVE-2026-30813 | PF Pandora FMS Pandora FMS | 8.8 | Apr 13 | SQL Injection in Module Search leads to Database Compromise |
| CVE-2026-30812 | PF Pandora FMS Pandora FMS | 5.4 | Apr 13 | Stored Cross-Site Scripting in Event Comments via Filter Bypass |
| CVE-2026-30811 | PF Pandora FMS Pandora FMS | 6.5 | Apr 13 | Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure |
| CVE-2026-30809 | PF Pandora FMS Pandora FMS | 8.8 | Apr 13 | OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution |
| CVE-2026-30806 | PF Pandora FMS Pandora FMS | 8.8 | Apr 13 | OS Command Injection in Network Report leads to Remote Code Execution |
| CVE-2026-30804 | PF Pandora FMS Pandora FMS | 7.2 | Apr 13 | Unrestricted File Upload in Extension Uploader leads to Remote Code Execution |
| CVE-2025-5306 | PF Pandora FMS Pandora FMS | 9.8 | Jun 27 | Command Injection in Netflow path |
| CVE-2025-4678 | PI Pandora ITSM Pandora FMS | 7.0 | Jun 10 | Remote Code Execution leads to Command Injection |
| CVE-2025-4653 | PI Pandora ITSM Pandora FMS | 7.0 | Jun 10 | Remote Code Execution leads to Command Injection |
| CVE-2024-12992 | PF Pandora FMS Pandora FMS | 9.8 | Mar 17 | Remote Code Execution leads to Command Injection |
| CVE-2024-12971 | PF Pandora FMS Pandora FMS | 8.8 | Mar 17 | QuickShell Authenticated Command Injection |