Colanode server versions through 0.4.7 have a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by using encoded traversal sequences in the avatarId parameter. This vulnerability enables attackers to escape the intended avatars directory and access .jpeg files from other workspaces. The vulnerability has a medium severity with a CVSS score of 4.3.
FlexPrice versions through 2.1.38 have an authentication bypass vulnerability in the HandleQuickBooksWebhook function. The flaw occurs because signature verification is skipped when the intuit-signature header is missing. This allows unauthenticated attackers who know a tenant and environment ID to replay forged payment notifications, potentially marking invoices as paid or overpaid.
CVE-2026-110696 is an information disclosure vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the dbtables.sql file. The vulnerability can be exploited remotely without authentication and has a medium severity score of 6.9. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-110695 is a medium severity buffer overflow vulnerability in the turboderp ExLlamaV2 software, specifically affecting versions 0.3.0, 0.3.1, and 0.3.2. The flaw exists in the STFile.get_tensor function within the Safetensors Tensor Loader component. An attacker can remotely trigger the vulnerability by manipulating the data_offsets argument, potentially causing a buffer overflow. Exploit code is publicly available, but no official patch or vendor response has been provided yet.
CVE-2026-110694 is an out-of-bounds read vulnerability in OAID Tengine up to version 1.12.0. It affects the get_tm_file_model function in the tmfile Model Loader component. The flaw arises from improper handling of the offset_root argument, allowing remote attackers to trigger an out-of-bounds read. The vulnerability has been publicly disclosed, but no official response or patch from the vendor is available yet. The CVSS 4.0 score rates this as a medium severity issue.
CVE-2026-110689 is a medium severity vulnerability in OpenClaw ClawScan up to version 0.1.6. It affects the Static Scanner component's function shouldSkipTargetPath, causing a protection mechanism failure when manipulated locally. Exploit code has been publicly released. Upgrading to version 0.1.7 addresses the issue.
CVE-2026-104109 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.23.0. The issue involves improper link resolution before file extraction, allowing an authenticated non-administrator with extract permission to overwrite or delete files outside the intended storage root if a symlink exists. The vulnerability is fixed in version 3.23.0.
FileRise 3.22.0 contains a path traversal vulnerability in the /api/file/saveFile.php endpoint. Authenticated users with inherited edit permissions and a valid CSRF token can exploit this flaw to create files outside authorized directories by using dot and dot-dot path segments. The issue arises because the application evaluates uncanonicalized folder input before access control checks and improperly validates directory containment. This vulnerability is fixed in version 3.23.0.
FileRise Pro versions prior to 3.24.0 contain a vulnerability where the /api/pro/portals/get.php endpoint exposes sensitive internal client portal information to unauthenticated users who know or guess the portal slug. This includes internal storage paths, client emails, form settings, and upload policies. The issue requires the Pro add-on and at least one configured portal. It is fixed in version 3.24.0.
FileRise versions prior to 3.23.0 contain an improper authentication vulnerability where the software maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 have an authentication flaw where failed TOTP verification attempts are tracked per session rather than account-wide. This allows an attacker with valid primary credentials to bypass the intended five-attempt limit for second-factor authentication by restarting login attempts in new sessions. The issue is resolved in version 3.23.0.
FileRise versions prior to 3.23.0 have an improper authentication vulnerability involving TOTP replay. The system validates a TOTP code within the accepted time window but does not prevent reuse of the same code for the same account during that window. An attacker with valid primary credentials and a captured TOTP code can replay the code in another login session before it expires. This vulnerability allows bypassing the intended one-time use of TOTP codes but does not disclose credentials or TOTP secrets. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 have a vulnerability that allows an authenticated attacker with a valid CSRF token to disable or enroll Time-based One-Time Password (TOTP) second factor authentication without recent full reauthentication. The enrollment endpoint prevents direct overwriting of an active TOTP secret but activates a newly generated secret before verifying possession. This flaw enables an attacker controlling an authenticated session to weaken or reset the second factor protection. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 contain an improper access control vulnerability in the /api/folder/renameFolder.php endpoint. Authenticated users who are not folder-scoped administrators can move a folder they own into another user's folder or the root namespace without proper authorization checks on the destination. This allows rekeying of ownership and ACLs to the new location. The vulnerability does not allow overwriting existing files and reveals limited information about destination paths through error messages. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.21.0 have an authentication weakness where failed login attempts are tracked only by source IP and username combination. This allows an unauthenticated attacker to bypass intended rate limits by rotating usernames, enabling password spraying attacks from a single source beyond the expected limit. The issue is fixed in version 3.21.0.
FileRise versions prior to 3.21.0 have an improper authentication vulnerability where disabled login methods can still be used to authenticate via backend endpoints if valid credentials are known. This bypasses administrator login-method policies but does not allow credential-free access. The issue is fixed in version 3.21.0.
FileRise versions from 3.9.0 up to but not including 3.22.0 contain a vulnerability involving the use of a hard-coded legacy compatibility key. This key can be activated in pristine manual installations lacking a persistent tokens key, allowing attackers who obtain certain encrypted account or configuration files to decrypt TOTP secrets or credentials. Docker installations are not affected due to unique persistent keys. The issue is resolved in version 3.22.0.
FileRise versions prior to 3.21.0 have a cross-site scripting (XSS) vulnerability due to improper neutralization of input in the branding.footerHtml value exposed via an unauthenticated public site configuration API. Although the frontend sanitizes this value before rendering, the raw HTML is exposed through the API, which could be unsafe for alternate clients or future render paths. An administrator must first store a malicious footer value to exploit this issue. The vulnerability is fixed in version 3.21.0.
CVE-2026-110679 is an out-of-bounds read vulnerability in OpenSIPS affecting versions 3.6.0 through 3.6.8 and 4.0.0 through 4.0.1. The flaw exists in the rtpproxy_offer and rtpproxy_answer functions of the rtpproxy component and can be triggered remotely. Upgrading to OpenSIPS versions 3.6.9 or 4.0.2 resolves the issue.
CVE-2026-0311 is a server-side request forgery (SSRF) vulnerability in Palo Alto Networks Checkov by Prisma® Cloud. It allows a local unauthenticated user to make unauthorized network requests from the host to internal services. The vulnerability has a low severity rating and no known exploits in the wild. No affected versions or patches are explicitly stated in the available data.