File-Manager

Veno File Manager 4.4.9 — Unauthenticated LFI to Superadmin Takeover (CVE-2026-37072) newCVE-2026-37072webCRITICALUnverified2026-07-05Veno File Manager 4.4.9 — Unauthenticated Email Hijack via SMTP Relay (CVE-2026-37073) newCVE-2026-37073webMEDIUMUnverified2026-07-05Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070) newCVE-2026-37070webMEDIUMUnverified2026-07-05Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071) newCVE-2026-37071webHIGHUnverified2026-07-05Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35) newCVE-2026-22804webHIGHPatched2026-07-05