Live Threat Intelligence Radar

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-110689 is a medium-severity vulnerability in OpenClaw ClawScan up to version 0.1.6 affecting the Static Scanner component's shouldSkipTargetPath function. It causes a protection mechanism failure when manipulated locally. The issue is fixed in version 0.1.7.

CVE-2026-104109 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.23.0. The issue involves improper link resolution before file extraction, allowing an authenticated non-administrator with extract permission to overwrite or delete files outside the intended storage root if a symlink exists. The vulnerability is fixed in version 3.23.0.

CVE-2026-104107 is a path traversal vulnerability in FileRise version 3.22.0 and earlier. It allows authenticated non-administrator users with inherited edit permissions and a valid CSRF token to create files outside their authorized directories by exploiting improper pathname limitation in the /api/file/saveFile.php endpoint. This can lead to unauthorized file creation beyond the intended folder, including outside the configured WebDAV root if backend credentials allow. The issue is fixed in FileRise version 3.23.0.

CVE-2026-104110 is a medium severity vulnerability in FileRise Pro versions prior to 3.24.0. It allows unauthenticated attackers who know or guess a client portal slug to access sensitive internal information such as storage folder paths, client contact emails, form settings, and upload policies via the /api/pro/portals/get.php endpoint. This exposure occurs because the endpoint returns full internal records instead of only curated branding data, which is intentionally exposed by a separate endpoint. Exploitation requires the Pro add-on and at least one configured portal. The issue is fixed in version 3.24.0.

FileRise versions prior to 3.23.0 have an improper authentication vulnerability where the application maps an authenticated OIDC identity to a local account using mutable claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.

FileRise versions prior to 3.23.0 have an improper restriction of excessive authentication attempts vulnerability related to TOTP verification. Attackers with valid primary credentials can bypass the intended five-attempt limit for TOTP by restarting the login workflow in a new session, allowing continued guessing of the second-factor code. This issue is fixed in version 3.23.0.

FileRise versions prior to 3.23.0 have an improper authentication vulnerability related to TOTP code replay. The application validates TOTP codes within an accepted time window but does not prevent reuse of the same code for the same account within that window. An attacker with valid primary credentials and a captured TOTP code can replay the code in another login session before it expires. This vulnerability does not disclose credentials or TOTP codes by itself. The issue is fixed in version 3.23.0.

FileRise versions prior to 3.23.0 contain a vulnerability where an authenticated user with a valid CSRF token can disable or enroll Time-based One-Time Password (TOTP) two-factor authentication without recent full reauthentication. This allows an attacker controlling an authenticated session to bypass the intended second-factor protections by disabling or enrolling TOTP without verifying possession of the authenticator. The issue is fixed in version 3.23.0.

CVE-2026-103988 is an improper access control vulnerability in FileRise before version 3.23.0. It allows an authenticated user who owns a source folder to move that folder tree into another user's folder or the root namespace without proper authorization checks on the destination. The moved folder's ownership and access control lists are updated to reflect the new location. The vulnerability does not allow overwriting existing files and reveals limited information about destination paths through error messages. This issue is fixed in FileRise version 3.23.0.