EUVD-2026-65538

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780

rclone before v1.75.0 contains a credential exposure vulnerability in its S3 redirect callback handling. The tool fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys when following redirects, allowing credentials to persist across scheme or host changes . An attacker positioned to o...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

ROOT-OS-DEBIAN-12-CVE-2024-25629 CVE-2024-25629 in c-ares - Patched by Root

Root has patched CVE-2024-25629 in the c-ares package for Root:Debian:12. Multiple fixed versions available...

DEBIAN-CVE-2026-55371

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

[SECURITY] Fedora 43 Update: libxls-1.6.3-5.fc43

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...

UBUNTU-CVE-2026-55371

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

[SECURITY] Fedora 44 Update: libxls-1.6.3-9.fc44

This is libxls, a C library for reading Excel files in the old binary OLE format, plus a command-line tool for converting XLS to CSV named, appropriately enough, libxls2csv...

CVE-2026-55371

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

CVE-2026-79780: Exposure of Sensitive Information to an Unauthorized Actor

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780: Exposure of Sensitive Information to an Unauthorized Actor

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-55371: Improper Input Validation

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes. The public setter validates the...

CVE-2026-38472: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

OPENSUSE-SU-2026:11593-1 c-ares-devel-1.34.8-1.1 on GA media

These are all security issues fixed in the c-ares-devel-1.34.8-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

CVE-2026-45018: Improper Neutralization of Special Elements used in an OS Command

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

PT-2026-81871

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax get jf which is later rendered in the data-tooltip attribute in...