CVE Intelligence

Xiaonuobase vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Xiaonuobase products: 1 record(s), with severity, exploitation and fixes.

Snowy 1

Exploited only (KEV) →

CVE-2026-110214 Low · 3.7 CWE-321 Oct 13, 2026
Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.