GO-2026-5062 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, filebrowser, mattermost-fips, rclone, hugo-fips, hugo-extended, hugo, rclone-fips, seaweedfs, seaweedfs-operator, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, mailpit-fips, mailpit, mattermost, listmonk...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: step-ca-fips, gogatekeeper, kyverno-policy-reporter-ui, cloudflared, tkn-fips, step-issuer-fips, sftpgo, kyverno-policy-reporter-ui-fips, telegraf, gitness, rclone-fips, caddy, step-fips, karma, caddy-fips, tkn, buf, step, dapr, dapr-fips, rclone, step-issuer, step-c...

GO-2023-2328 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2024-3271 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: seaweedfs, mattermost, rclone, hugo...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: hugo-extended, rclone, mailpit, mattermost, ollama, seaweedfs, hugo...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: hugo-extended, rclone, mailpit, mattermost, filebrowser, seaweedfs, hugo...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: rclone, mcp-grafana, malcontent, kubevela, witness, maru, grafana, nfpm, cri-tools, vcluster, tempo, grafana-alloy, gitlab-runner, weaviate, minio, dgraph, prometheus, k8sgpt, terragrunt, eksctl, terraform-mcp-server, lazygit, nuclei, k3s, teleport, redpanda,...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: cloudflared, step-issuer, tkn, rclone, step-ca, kyverno-policy-reporter-ui, step, karma, caddy, buf, sftpgo, gitness, gogatekeeper...

GO-2026-4961 vulnerabilities

Vulnerabilities for packages: rclone, gitea, mattermost, bento, ollama, kubescape, seaweedfs, pdfcpu...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: rclone, gitea, mailpit, mattermost, bento, ollama, kubescape, seaweedfs, pdfcpu...

GO-2026-5490 vulnerabilities

Vulnerabilities for packages: rancher-fleet, syft, rclone, terragrunt, gitaly, telegraf, external-secrets-operator, scorecard, teleport, argo-cd, cerbos, flux...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: rancher-fleet, syft, rclone, terragrunt, gitaly, telegraf, external-secrets-operator, scorecard, teleport, argo-cd, cerbos...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: harbor-registry, fluent-bit-plugin-loki, spire-server, rclone, grafana-agent-operator, velero, sigstore-scaffolding, zot, rook, hugo, py3-azure-identity, falcoctl, flux-source-controller, tekton-chains, flux-kustomize-controller, prometheus-operator, step-ca, ksops,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: kaniko, crossplane-provider-aws-sqs, crossplane-provider-aws-eks, spire-server, grype, rclone, crossplane-provider-aws-kinesis, flux-image-automation-controller, kubevela, scorecard, pulumi-kubernetes-operator, wolfictl, zarf, zot, vexctl,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nova, migrate, docker-credential-gcr, zot, bom, falcoctl, wgcf, cloud-sql-proxy, kor, grafana-alloy, rancher-system-upgrade-controller, delve, terraform-mcp-server, emissary, nuclei, spire-controller-manager, nri-memcached, steampipe, trivy, gobump,...

GO-2026-5596 Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

The --rc-serve path in rclone allows unauthenticated remote instantiation, enabling unauthenticated command execution. An attacker can use inline remote backend options such as sftp ssh to run arbitrary commands as the rclone user...

GO-2026-5466 Unauthenticated backend instantiation in github.com/rclone/rclone

The operations/fsinfo remote control RC endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it e.g...

CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...

CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through...