CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-12036

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...

CVE-2026-63426

CVE-2026-63426 concerns Lenovo Dock Manager. An authenticated local user can delete arbitrary files with elevated privileges due to a vulnerability described in the provided documents. CVSS metrics indicate a local, low-complexity condition with low privileges required and no user interaction, wi...

CVE-2026-63426

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...

CVE-2026-63426

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...

EUVD-2026-58057

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...

CVE-2026-12036

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...

CVE-2026-12036

The CVE-2026-12036 entry concerns the VantageCoreAddin component used by Lenovo Vantage and Lenovo Commercial Vantage. Description: an improper link following vulnerability could allow a local authenticated user to perform arbitrary file deletion with elevated privileges. The CVSS metrics indicat...

EUVD-2026-58056

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...

EUVD-2026-58051

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

EUVD-2026-58045

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a director...

CVE-2026-70459

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a director...

CVE-2026-70459

rsync 3.0.0 before 3.5.0 is affected by a null pointer dereference in the daemon child process when processing a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the entry as a directory structure pointer without type verification, causing an invalid/un...

CVE-2026-70460

CVE-2026-70460 affects rsync 2.3.3 prior to 3.5.0. The issue is a path traversal vulnerability where a malicious sender can escape the module root by exploiting symlinks in the module file tree when using --partial-dir or --backup-dir. With write access or a pre-existing trusted symlink, an attac...

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

EUVD-2026-58044

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

EUVD-2026-58039

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...