What’s Vulnerable › Products
Pandora FMS vulnerabilities
75 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your Pandora FMS version is affected
Latest Pandora FMS vulnerabilities
- CVE-2026-75786 — SQL Injection in Grafana Integration Endpoint (query.php) (CVSS 7.2)
- CVE-2026-64950 — Stored Cross-Site Scripting via Directory Name in File Manager Create Directory (CVSS 8.4)
- CVE-2026-64949 — Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager (CVSS 8.6)
- CVE-2026-64948 — Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure (CVSS 7.1)
- CVE-2026-64947 — CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager (CVSS 7.5)
- CVE-2026-64946 — CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager (CVSS 7.4)
- CVE-2026-34190 — CSRF in Alert Command Deletion (CVSS 5.9)
- CVE-2026-34189 — CSRF in Event Response Deletion (CVSS 5.9)
- CVE-2026-34187 — SQL Injection in Graph Container Parameter (CVSS 9.8)
- CVE-2026-30810 — Server-Side Request Forgery in API Checker leads to Privilege Escalation (CVSS 8.8)
- CVE-2026-30808 — Session Fixation in Authentication leads to Session Hijacking (CVSS 8.1)
- CVE-2026-30807 — Cross-Site Request Forgery on Extension Pages (CVSS 8.8)
- CVE-2026-30805 — Insecure Default Initialization in API Authentication leads to Authentication Bypass (CVSS 9.1)
- CVE-2026-34188 — OS Command Injection in Event Response Execution (CVSS 7.2)
- CVE-2026-34186 — SQL Injection in Custom Fields leads to Database Compromise (CVSS 8.8)
- CVE-2026-30813 — SQL Injection in Module Search leads to Database Compromise (CVSS 8.8)
- CVE-2026-30812 — Stored Cross-Site Scripting in Event Comments via Filter Bypass (CVSS 5.4)
- CVE-2026-30811 — Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure (CVSS 6.5)
- CVE-2026-30809 — OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution (CVSS 8.8)
- CVE-2026-30806 — OS Command Injection in Network Report leads to Remote Code Execution (CVSS 8.8)
- CVE-2026-30804 — Unrestricted File Upload in Extension Uploader leads to Remote Code Execution (CVSS 7.2)
- CVE-2025-5306 — Command Injection in Netflow path (CVSS 9.8)
- CVE-2024-12992 — Remote Code Execution leads to Command Injection (CVSS 9.8)
- CVE-2024-12971 — QuickShell Authenticated Command Injection (CVSS 8.8)
- CVE-2024-35307 — Argument Injection Leading to Remote Code Execution in Realtime Graph Extension (CVSS 9.8)