CVE-2026-73647

The vulnerability CVE-2026-73647 affects Quasar Framework prior to version 2.22.0. The public extend() utility in ui/src/utils/extend/extend.js recursively copies attacker-controlled keys during deep merges (extend(true, target, source)) and does not reject an own proto property. This could cause...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

ALPINE-CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

AZL-95822 CVE-2026-53786 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability. Authenticated clients can bypass module-level filter restrictions by injecting malicious --filter merge file directives during filter evaluation, allowing access to files the filter would normally exclude. This is the underlying root...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

EUVD-2026-58093

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

EUVD-2026-58088

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-53802: UNIX Symbolic Link (Symlink) Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-53786: Incorrect Authorization

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

PT-2026-71625

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Authenticated clients can bypass module-level filter restrictions by providing malicious --filter merge file directives. During filter evaluation, attackers can inject client-side merge file directives...

PT-2026-71723

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-6821

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a...

CVE-2026-4879

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...