CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-57490

Prior to version 3.16.0 , the self-hosted file manager FileRise is vulnerable to an authentication bypass when WebDAV is enabled. The root cause lies in the public/webdav.php authentication callback, which validates only the username and password via AuthModel::authenticate() while failing to enf...

CVE-2026-57490

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

EUVD-2026-101637

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-57490 FileRise: WebDAV authentication bypasses TOTP/MFA entirely

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-57490 FileRise: WebDAV authentication bypasses TOTP/MFA entirely

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-110669

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

CVE-2026-57489

Prior to version 3.16.0 , FileRise (a self-hosted web-based file manager) is vulnerable to a full authentication bypass when the AUTH_BYPASS feature is enabled. The root cause is that the application trusts configured reverse-proxy identity headers without validating that the request originated f...

CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-100232

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

Exploit for CVE-2026-109506

CVE-2026-109506: Improper Authentication in Multiple TP-Link W...

CVE-2026-110669

A security vulnerability exists in cemtan sar2html version 4.0.0 . The flaw is located in the deleteHost/deleteRange/deleteAll functions within the sar2html.py file, leading to missing authentication . This vulnerability can be exploited remotely , potentially allowing unauthorized manipulation o...

CVE-2026-110669

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

CVE-2026-110669 cemtan sar2html sar2html.py deleteAll missing authentication

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

EUVD-2026-101623

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

DEBIAN-CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...