{"metadata": {"vulnerability": "CVE-2026-103977", "count": 11, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-01T16:09:08.456Z", "date_only": false, "value": "2026-10-01T16:09:08.456Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103977", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T03:00:06Z", "date_only": false, "value": "2026-10-02T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/i3fXBslgjZoZ9-BkV1f35kP30UVmFNa5ZOUTXg5KEMOJv9c", "record": "CVE-2026-103977", "field": "creation_timestamp", "uuid": "c4239f61-83e7-4059-a8d3-b165d0093378"}, {"timestamp": "2026-10-14T20:38:39.485Z", "date_only": false, "value": "2026-10-14T20:38:39.485Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103977", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T20:38:39.485Z", "date_only": false, "value": "2026-10-14T20:38:39.485Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-103977", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T21:17:33.850Z", "date_only": false, "value": "2026-10-14T21:17:33.850", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103977", "record": "FKIE_CVE-2026-103977", "field": "published"}, {"timestamp": "2026-10-15T00:40:26.184Z", "date_only": false, "value": "2026-10-15T00:40:26.184114Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117442138972795799", "record": "CVE-2026-103977", "field": "creation_timestamp", "uuid": "ba509113-5906-4897-bdfb-818fb444f6eb", "content": "CVE-2026-103977 FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103977https://github.com/error311/FileRise/security/advisories/GHSA-4hfj-6478-5cv7https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68ahttps://github.com/error311/FileRise/releases/tag/v3.23.0#error311 #FileRise#CVE_2026_103977#bot", "url": "https://infosec.exchange/users/cve/statuses/117442138972795799"}, {"timestamp": "2026-10-20T02:10:15.462Z", "date_only": false, "value": "2026-10-20T02:10:15.462870Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103977", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T02:10:15.462Z", "date_only": false, "value": "2026-10-20T02:10:15.462870Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103977", "record": "FKIE_CVE-2026-103977", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T02:10:25.191Z", "date_only": false, "value": "2026-10-20T02:10:25.191Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103977", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:10:25.191Z", "date_only": false, "value": "2026-10-20T02:10:25.191Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103977", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T03:17:12.363Z", "date_only": false, "value": "2026-10-20T03:17:12.363", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103977", "record": "FKIE_CVE-2026-103977", "field": "lastModified"}]}