13779 matches found
CVE-2026-71313: Improper Limitation of a Pathname to a Restricted Directory
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...
PT-2026-81372
Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4 Description The local backend fails to mask special permission bits when applying source-supplied mode metadata. This allows an attacker to set setuid or setgid bits on files they control. When copying files wit...
PT-2026-67940
Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A weakness in the Backend RPC component allows for remote OS command injection. This occurs through the manipulation of the File argument within the file.exec function of the '/api/esps' endpoint...
PT-2026-68155
Name of the Vulnerable Software and Affected Versions ChirpStack affected versions not specified Description An authenticated user with device-list access can perform SQL injection when the SQLite backend is used. The issue occurs because the user-supplied tag key is interpolated directly into a...
CVE-2026-18900: Improper Neutralization of Special Elements used in an OS Command
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public...
CVE-2026-71282: Improper Neutralization of Special Elements used in an SQL Command
ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...
PT-2026-68328
Name of the Vulnerable Software and Affected Versions rclone versions 1.40.0 through 1.74.0 Description The serve restic command fails to properly reject URL paths starting with ../ in the WithRemote function within cmd/serve/restic/restic.go. This allows a leading parent path to be passed to GET...
CVE-2026-71313: Improper Limitation of a Pathname to a Restricted Directory
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...
📄 LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
CVE-2026-71312: Improper Neutralization of Special Elements used in an OS Command
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
CVE-2026-71311: Improper Neutralization of CRLF Sequences
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
PT-2026-68331
Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...
PT-2026-75956
Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...
PT-2026-68333
Name of the Vulnerable Software and Affected Versions rclone versions 1.51.0 through 1.74.0 Description The local backend in backend/local/local.go relies on a configurable filename encoder to prevent remote filename data from being interpreted as operating-system path syntax. When a local...
CVE-2026-70619
Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...
CVE-2026-67858
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...
CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
DEBIAN-CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
CVE-2026-67858
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...