CVE-2026-75464

HighCVSS 8.1/10Last modified Oct 12, 2026

Description

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-754657.5The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails toCVE-2026-754666.5libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image wiCVE-2026-75474.9The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and iCVE-2026-754763.1Tanium addressed a compression bomb vulnerability in Threat Response.CVE-2026-754797.5JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackCVE-2026-75488.8A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgCVE-2026-754806.5OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticatCVE-2026-754818.8SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. AttCVE-2026-754827.5SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory dirCVE-2026-754833.3powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers CVE-2026-754846.9Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smCVE-2026-754855.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in r
CVE-2026-75464: High severity, CVSS 8.1 | Vulnix