64 matches found
CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...
CVE-2026-40034 affecting package rust for versions less than 1.75.0-30
CVE-2026-40034 affecting package rust for versions less than 1.75.0-30. A patched version of the package is available...
CVE-2026-5222 affecting package rust for versions less than 1.75.0-30
CVE-2026-5222 affecting package rust for versions less than 1.75.0-30. A patched version of the package is available...
CVE-2026-5223 affecting package rust for versions less than 1.75.0-30
CVE-2026-5223 affecting package rust for versions less than 1.75.0-30. A patched version of the package is available...
CVE-2026-33056 affecting package rust for versions less than 1.75.0-28
CVE-2026-33056 affecting package rust for versions less than 1.75.0-28. A patched version of the package is available...
CVE-2026-34743 affecting package rust for versions less than 1.75.0-28
CVE-2026-34743 affecting package rust for versions less than 1.75.0-28. A patched version of the package is available...
CVE-2026-33055 affecting package rust for versions less than 1.75.0-28
CVE-2026-33055 affecting package rust for versions less than 1.75.0-28. A patched version of the package is available...
CVE-2026-25541 affecting package rust for versions less than 1.75.0-27
CVE-2026-25541 affecting package rust for versions less than 1.75.0-27. A patched version of the package is available...
CVE-2026-24116 affecting package rust for versions less than 1.75.0-25
CVE-2026-24116 affecting package rust for versions less than 1.75.0-25. A patched version of the package is available...
CVE-2025-58160 affecting package rust for versions less than 1.75.0-25
CVE-2025-58160 affecting package rust for versions less than 1.75.0-25. A patched version of the package is available...
CVE-2023-48795 affecting package rust for versions less than 1.75.0-24
CVE-2023-48795 affecting package rust for versions less than 1.75.0-24. An upgraded version of the package is available that resolves this issue...
AZL-77087 CVE-2026-25727 affecting package rust for versions less than 1.75.0-27
time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are...
CVE-2025-68671
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
CVE-2025-68671
lakeFS - S3 gateway vulnerability: missing timestamp validation in authenticated requests allows replay attacks. Attackers can reuse valid signed requests until credentials rotate; impact is limited to replay of previously captured requests. Affected: lakeFS S3 gateway; root cause is lack of time...
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
GHSA-F2PH-GC9M-Q55F lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
lakeFS security vulnerability
LakeFS is an open-source tool developed by Treeverse. It allows you to convert your object storage into a repository similar to Git. Versions of LakeFS prior to 1.75.0 contained security vulnerabilities. These vulnerabilities stemmed from the S3 gateway not verifying the timestamps in authenticat...
