CVE-2026-0311 is a server-side request forgery (SSRF) vulnerability in Palo Alto Networks Checkov by Prisma Cloud. It allows a local unauthenticated user to make unauthorized network requests from the host to internal services. The vulnerability affects versions from 0 up to but not including 3.2.533. The CVSS 4.0 base score is 1.1, indicating low severity. There are no known exploits in the wild and no vendor-provided patch information is available at this time.
CVE-2026-0312 is a path traversal vulnerability in Palo Alto Networks Checkov by Prisma Cloud that allows an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. This vulnerability affects versions from 0 up to but not including 3.3.25. The CVSS 4.0 base score is 4.3, indicating a medium severity issue. There is no indication of known exploits in the wild. The vulnerability requires local access and user interaction, with limited impact on confidentiality and availability.
CVE-2026-0313 is a command injection vulnerability in Palo Alto Networks Cortex XSOAR OS Query content pack. It allows an authenticated administrator to execute arbitrary operating system commands on remote endpoints. The vulnerability affects versions from 0 up to but not including 1.0.17. The CVSS 4.0 base score is 6.1, indicating a medium severity. There are no known exploits in the wild and no patch information is provided in the input data.
FileRise versions prior to 3.20.0 contain a vulnerability where the /api/file/snippet.php endpoint does not enforce an authenticated-session guard before processing short text preview requests. While the endpoint performs access control list (ACL) checks, unauthenticated requests can reach the ACL evaluation stage instead of being immediately rejected with a 401 response. Exploitation requires unusual proxy-header or ACL misconfiguration. This issue is fixed in version 3.20.0.
CVE-2026-0314 is a type confusion vulnerability in the Palo Alto Networks GlobalProtect app on Windows. It allows a local user with low privileges to cause a denial of service (DoS) condition. Other platforms such as Linux, macOS, iOS, Android, and Chrome OS are not affected. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-62664 is a path traversal vulnerability in FileRise, a self-hosted web-based file manager. Versions prior to 3.19.0 do not properly reject dot-dot path segments in folder creation requests, allowing authenticated low-privileged users with appropriate permissions to create directories outside the intended upload directory. This can lead to unauthorized directory creation wherever the web server account has write access. The issue is fixed in FileRise version 3.19.0.
CVE-2026-0315 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app for macOS. It allows a local non-administrative user to escalate privileges to root by exploiting an untrusted search path issue. Other platforms such as Linux, Windows, iOS, Android, and Chrome OS are not affected. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CVE-2026-61844 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.18.0. The issue arises from how FileRise flattens logical folder paths into metadata filenames, causing distinct folders to share one metadata file. This allows a low-privileged user with control over one colliding folder and read_own access to another folder to manipulate metadata, potentially gaining unauthorized read and edit access to files. The vulnerability is fixed in version 3.18.0.
CVE-2026-0316 is a stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). It allows a malicious authenticated administrator to store or execute JavaScript payloads via the web interface. The vulnerability does not affect Cloud NGFW or Prisma Access. The risk is reduced if management interfaces are restricted to trusted internal IPs. The CVSS score is low (1.1).
FileRise versions prior to 3.18.0 contain a missing authorization vulnerability that allows unauthenticated users with a valid share token and any configured share password to overwrite existing files by uploading a file with the same name. This flaw also affects authenticated uploads where users lack edit permissions, enabling silent replacement of file content without changing the original uploader metadata. The issue is resolved in version 3.18.0.
FileRise versions prior to 3.16.0 have an insufficient session expiration vulnerability where the isAdmin flag is stored in remember-me tokens and not updated upon user role changes. This allows a user with a pre-demotion token to retain administrator privileges after their role has been downgraded. The issue is fixed in version 3.16.0.
CVE-2026-0317 is a low-severity denial of service (DoS) vulnerability in Palo Alto Networks PAN-OS software affecting certain versions. An authenticated user with a read-only administrator role can cause a DoS by sending a specially crafted API request. The risk is mitigated by restricting management web interface access to trusted internal IP addresses. Cloud NGFW, Panorama, and Prisma Access are not affected by this issue.
FileRise versions prior to 3.16.0 have a vulnerability where the application treats an empty or missing users.txt file as a fresh installation, allowing an unauthenticated remote attacker to create a new initial administrator account. This occurs because the application lacks a durable setup-complete marker independent of the user store. The issue is fixed in version 3.16.0.
FileRise versions prior to 3.16.0 have a vulnerability in their WebDAV Basic authentication implementation where the second factor of authentication (TOTP) is not enforced. This allows an attacker with valid primary credentials to bypass two-factor authentication and access WebDAV file permissions. The browser login path correctly enforces TOTP, but the WebDAV authentication callback does not. This issue is fixed in version 3.16.0.
CVE-2026-0318 is a medium severity stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama. Exploitation can cause a denial of service (DoS) condition, with repeated attempts forcing Panorama into maintenance mode. Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected by this issue.
FileRise versions prior to 3.16.0 contain a vulnerability where archive extraction does not properly enforce upload filename restrictions before writing files to disk. An authenticated user with upload and extract permissions can upload a ZIP archive containing files with blocked extensions, such as PHP scripts, which are then extracted and saved despite normal upload restrictions. This can lead to unauthorized code execution if the deployment executes uploaded content. The issue is fixed in version 3.16.0.
FileRise versions prior to 3.16.0 with AUTH_BYPASS enabled are vulnerable to an authentication bypass vulnerability. This occurs because the application trusts the reverse-proxy identity header without verifying the request's origin from trusted proxies. An attacker can exploit this by directly accessing the backend port and supplying the X-Remote-User header to impersonate any user, including administrators, without authentication. The vulnerability is fixed in version 3.16.0.
CVE-2026-0319 is an input handling vulnerability in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. It allows an authenticated user to establish a GlobalProtect session impersonating another user. This issue affects specific versions of PAN-OS but does not impact the Cloud NGFW or Panorama products. The vulnerability has a medium severity rating with a CVSS score of 4.9.
CVE-2026-110670 is a medium severity SQL injection vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the updateDb function of the sar2html.py file within the Archive Processing component. It allows remote attackers to manipulate the s2host argument to perform SQL injection. No patch or vendor response has been reported yet.