CVE Tools
Track your stack

Pandora Fms

123 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Pandora Fms, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Pandora Fms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Pandora Fms CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-020
2025-032
2025-040
2025-050
2025-061
2025-073
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-048
2026-055
2026-060
2026-070
2026-080
2026-090
2026-108

Severity

How the 123 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1917%
  • High4338%
  • Medium4540%
  • Low65%

Latest CVEs

The 15 most recently published vulnerabilities affecting Pandora Fms.

  1. CVE-2026-75786SQL Injection in Grafana Integration Endpoint (query.php)—
  2. CVE-2026-64950Stored Cross-Site Scripting via Directory Name in File Manager Create Directory—
  3. CVE-2026-64949Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager—
  4. CVE-2026-64948Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure—
  5. CVE-2026-64947CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager—
  6. CVE-2026-64946CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager—
  7. CVE-2026-34190CSRF in Alert Command Deletion—
  8. CVE-2026-34189CSRF in Event Response Deletion—
  9. CVE-2026-34187SQL Injection in Graph Container Parameter9.8
  10. CVE-2026-30810Server-Side Request Forgery in API Checker leads to Privilege Escalation8.8
  11. CVE-2026-30808Session Fixation in Authentication leads to Session Hijacking8.1
  12. CVE-2026-30807Cross-Site Request Forgery on Extension Pages8.8
  13. CVE-2026-30805Insecure Default Initialization in API Authentication leads to Authentication Bypass9.1
  14. CVE-2026-34188OS Command Injection in Event Response Execution7.2
  15. CVE-2026-34186SQL Injection in Custom Fields leads to Database Compromise8.8

Product grouping is registry-driven, with AI assist and human review. How it works