PT-2026-73431

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

PT-2026-73434

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

PT-2026-73432

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

PT-2026-73433

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: nemo, seaweedfs-operator, seaweedfs-fips, bento-fips, seaweedfs-rocksdb-fips, gitea, bento, ollama, kubescape-server, seaweedfs-rocksdb, mailpit, fortio, kubescape, seaweedfs, kitty, pdfcpu, seaweedfs-operator-fips, mailpit-fips, gitea-fips, mattermost, rclone-fips,...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: nemo, seaweedfs-operator, seaweedfs-fips, bento-fips, seaweedfs-rocksdb-fips, gitea, bento, ollama, kubescape-server, seaweedfs-rocksdb, mailpit, fortio, kubescape, seaweedfs, kitty, pdfcpu, seaweedfs-operator-fips, mailpit-fips, gitea-fips, mattermost, rclone-fips,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: bento, gitea, kubescape, kitty, pdfcpu, mailpit, seaweedfs, mattermost, rclone, ollama...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: bento, gitea, kubescape, kitty, pdfcpu, mailpit, seaweedfs, mattermost, rclone, ollama...

GO-2024-3271 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2023-2328 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: rclone-fips, mailpit, seaweedfs-operator, rclone, hugo, mattermost-fips, seaweedfs, ollama-fips, ollama, hugo-fips, seaweedfs-operator-fips, hugo-extended, mailpit-fips, seaweedfs-fips, mattermost, listmonk...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: rclone-fips, rclone, mattermost-fips, hugo, seaweedfs, seaweedfs-operator-fips, gitlab-workhorse-ce, seaweedfs-operator, seaweedfs-fips, mattermost, listmonk...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: rclone-fips, mailpit, seaweedfs-operator, seaweedfs-rocksdb, rclone, hugo, filebrowser, mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, hugo-fips, seaweedfs-operator-fips, gitlab-workhorse-ce, hugo-extended, mailpit-fips, seaweedfs-fips, mattermost, listmonk...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: step-issuer, caddy, step-issuer-fips, step-fips, kyverno-policy-reporter-ui, tkn-fips, gitness, cloudflared, karma, step-ca, step, gogatekeeper, dapr, step-ca-fips, rclone-fips, dapr-fips, kyverno-policy-reporter-ui-fips, caddy-fips, tkn, sftpgo, telegraf, rclone, bu...

GO-2023-2328 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2024-3271 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: seaweedfs, rclone, mattermost, hugo...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: hugo-extended, hugo, mailpit, seaweedfs, mattermost, rclone, ollama...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: hugo-extended, filebrowser, hugo, mailpit, mattermost, rclone, seaweedfs...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: grafana, eksctl, maru, minio, datadog-agent, k8sgpt, goreleaser, redpanda, witness, rclone, opentelemetry-collector-contrib, malcontent, cri-tools, grafana-alloy, nfpm, tempo, lazygit, loki, dagger, terraform-mcp-server, dgraph, nuclei, weaviate, teleport,...