CVE-2026-104106 FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no...

CVE-2026-0313

Palo Alto Networks Cortex XSOAR and Cortex XSIAM are affected by a command injection vulnerability within the OS Query content pack . This flaw allows an authenticated administrator to execute arbitrary OS commands on remote endpoints. To mitigate this issue without an immediate upgrade, users ca...

CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

EUVD-2026-101674

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

CVE-2026-62664 FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder constructs and creates the destination. An...

CVE-2026-0317

A denial of service (DoS) vulnerability exists in Palo Alto Networks PAN-OS software. The flaw allows an authenticated user with a read-only administrator role to trigger a DoS condition by submitting a specially crafted API request . To minimize risk, it is recommended to restrict management int...

CVE-2026-55384

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, subtotal, tax, discountval, and dueamount...

CVE-2026-55387

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's...

CVE-2026-57491

The FileRise self-hosted web-based file manager is vulnerable to a bypass of the upload blocklist prior to version 3.16.0 . The ZipArchive::extractTo() function fails to apply the UploadNamePolicy::isAllowedForWrite() check during archive extraction. This allows an authenticated user with upload ...

EUVD-2026-101633

An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability...

CVE-2026-0319 PAN-OS: Improper Input Handling Vulnerability

An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability...

EUVD-2026-101630

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

CVE-2026-100232

A post-authentication OS Command Injection vulnerability exists in the SonicWall Network Security Manager (NSM) on-prem (supporting VMWare, Hyper-V, Azure, and KVM). Due to improper neutralization of special elements used in an OS command, a remote authenticated attacker could execute arbitrary c...

CVE-2026-55382 InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

Security Bulletin: IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting (XSS) vulnerability

Summary IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting XSS vulnerability that allows an authenticated user to embed arbitrary JavaScript into the Web UI. This could alter intended application behaviour and potentially lead to credentials disclosure within a trusted...

EUVD-2026-101609

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's...

CVE-2026-55387

The InvoiceShelf web and mobile application (version 2.3.3 and earlier ) is vulnerable to an improper access control flaw during bulk-delete operations. The issue stems from the fact that validators for several request types—including DeleteCustomersRequest , DeleteEstimatesRequest , DeleteExpens...

EUVD-2026-101587

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...

CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...

CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...