CVE-2026-64950
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
- Published Oct 1, 2026
- CVSS 8.4 high
- 0.2% chance of exploitation in the next 30 days (EPSS)