CVE-2026-116192

The rclone utility versions 1.37 before 1.74.2 is vulnerable to a Server-Side Request Forgery (SSRF) . This issue occurs when using the --rc-serve flag, allowing unauthenticated attackers to redirect http and netstorage backend requests. The vulnerability is triggered by supplying a double-slash ...

CVE-2026-116193

Rclone versions 1.64.0 through 1.75.2 are vulnerable to an authentication bypass in the serve webdav functionality. The flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS requests . By probing arbitrary paths and analyzing the Allow header values, attackers can dete...

EUVD-2026-109451

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

EUVD-2026-109450

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to...

CVE-2026-116191

Rclone versions prior to 1.75.2 are vulnerable to a path traversal flaw in the serve webdav functionality. The root cause is the lack of validation for '..' path components , allowing unauthenticated attackers to escape the served root directory. By sending an MKCOL /.. request, an attacker can p...

EUVD-2026-109449

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...

CVE-2026-116188

The rclone serve s3 component in versions 1.75.0 before 1.75.2 is vulnerable to an integer overflow within the multipart reorder-memory accounting logic. This flaw allows an attacker to bypass configured buffer limits by initiating two concurrent current-part PUT requests with extremely large dec...

EUVD-2026-109446

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116187

Rclone versions v1.68.0 before v1.75.2 are vulnerable to an authorization bypass in the serve s3 --auth-proxy functionality. The root cause allows authenticated tenants to manipulate multipart uploads belonging to other tenants by referencing their specific upload IDs . If an attacker obtains a v...

EUVD-2026-109445

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject part...

qu1ckdr0p2

About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...

CVE-2026-47668

CVE-2026-47668 — DbGate Remote Code Execution Unauthenticated RCE in DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Assessment tool: CVE-2026-47668.py — authorized testing only. | ---|--- CVE| CVE-2026-47668 Severity| Critical Product| DbGate / dbgate-serve Affected| ≤ 7.1.8 Fixed| ≥ 7.1.9 CVSS...

CVE-2026-56836

The PraisonAI multi-agent system (versions 4.5.112 through 4.6.58 ) contains a vulnerability where the deprecated Typer recipe serve command bypasses non-localhost authentication guards. Because the command fails to set the auth configuration, the create_app() function does not attach required AP...

CVE-2026-56836 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

CLSA-2026-1792428111 TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.9...

CLSA-2026-1792428109 TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.8...

CLSA-2026-1792428106 TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.6...

CLSA-2026-1792428107 TuxCare security update for @react-router/serve (3 CVEs)

TuxCare rebuilt @react-router/serve to address 3 CVEs. Fixed in 7.5.1-tuxcare.5...

GHSA-VX2M-GPQ4-8J5Q LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...