THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,906 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-104106 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, Fil…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker con…
CVE-2026-104106Read original ↗ (opens in a new tab) - NVD
CVE-2026-104105 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, Fil…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the target account's valid primary credential and captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes. The issue does not by itself disclose the primary cr…
CVE-2026-104105Read original ↗ (opens in a new tab) - NVD
CVE-2026-103988 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, Fil…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A qualifying user who owns a source folder can move that tree beneath another user's existing folder or into the root namespace, and the operation rekeys the moved ownership and…
CVE-2026-103988Read original ↗ (opens in a new tab) - NVD
CVE-2026-103977 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, Fil…
High · CVSS 3.1 8.1 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. T…
CVE-2026-103977Read original ↗ (opens in a new tab) - NVD
CVE-2026-100232 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability…
High · CVSS 3.1 7.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
CVE-2026-100232Read original ↗ (opens in a new tab) - NVD
CVE-2026-0320 — A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass sy…
Medium · CVSS 4.0 6.1 · Assessor: [email protected]
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloalt…
CVE-2026-0320Read original ↗ (opens in a new tab) - NVD
CVE-2026-0319 — An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an auth…
Medium · CVSS 4.0 4.9 · Assessor: [email protected]
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.
CVE-2026-0319Read original ↗ (opens in a new tab) - NVD
CVE-2026-0318 — A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Pa…
Medium · CVSS 4.0 4.6 · Assessor: [email protected]
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode. Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.
CVE-2026-0318Read original ↗ (opens in a new tab) - NVD
CVE-2026-0317 — A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only admin…
Low · CVSS 4.0 1.2 · Assessor: [email protected]
A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-h…
CVE-2026-0317Read original ↗ (opens in a new tab) - NVD
CVE-2026-0316 — A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated a…
Low · CVSS 4.0 1.1 · Assessor: [email protected]
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/…
CVE-2026-0316Read original ↗ (opens in a new tab) - NVD
CVE-2026-0315 — A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate the…
Medium · CVSS 4.0 5.9 · Assessor: [email protected]
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
CVE-2026-0315Read original ↗ (opens in a new tab) - NVD
CVE-2026-0314 — A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges…
Medium · CVSS 4.0 4.3 · Assessor: [email protected]
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.
CVE-2026-0314Read original ↗ (opens in a new tab) - NVD
CVE-2026-0313 — A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authe…
Medium · CVSS 4.0 6.1 · Assessor: [email protected]
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
CVE-2026-0313Read original ↗ (opens in a new tab) - NVD
CVE-2026-0312 — Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write…
Medium · CVSS 4.0 4.3 · Assessor: [email protected]
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
CVE-2026-0312Read original ↗ (opens in a new tab) - NVD
CVE-2026-0311 — A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated u…
Low · CVSS 4.0 1.1 · Assessor: [email protected]
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
CVE-2026-0311Read original ↗ (opens in a new tab) - NVD
CVE-2026-55684 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobr…
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL…
CVE-2026-55684Read original ↗ (opens in a new tab) - NVD
CVE-2026-55683 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobr…
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The sam…
CVE-2026-55683Read original ↗ (opens in a new tab) - NVD
CVE-2026-55682 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php r…
High · CVSS 3.1 8.1 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affec…
CVE-2026-55682Read original ↗ (opens in a new tab) - NVD
CVE-2026-55681 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patr…
High · CVSS 3.1 8.8 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data…
CVE-2026-55681Read original ↗ (opens in a new tab) - NVD
CVE-2026-55680 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/…
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including…
CVE-2026-55680Read original ↗ (opens in a new tab) - NVD
CVE-2026-55679 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpo…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands a…
CVE-2026-55679Read original ↗ (opens in a new tab) - NVD
CVE-2026-55498 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, Fil…
Medium · CVSS 3.1 4.8 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths r…
CVE-2026-55498Read original ↗ (opens in a new tab) - NVD
CVE-2026-55387 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 4.0 7.2 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist b…
CVE-2026-55387Read original ↗ (opens in a new tab) - NVD
CVE-2026-55386 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 4.0 7.1 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This iss…
CVE-2026-55386Read original ↗ (opens in a new tab) - NVD
CVE-2026-55385 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
Medium · CVSS 3.1 6.8 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner…
CVE-2026-55385Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.