CVE-2026-77368

SeaweedFS version 4.39 contains an authenticated cross-prefix IDOR in the filer's TUS resumable-upload handler . The JWT allowed_prefixes scoping is enforced only when an upload session is created; the HEAD , PATCH , and DELETE verbs that operate on an existing session by its identifier never re-...

CVE-2026-79778

rclone before v1.75.0 is affected by a denial of service vulnerability in the WebDAV TUS creation handler . The handler dereferences a nil response before checking for transport errors, meaning a malicious or compromised configured endpoint that resets connections during TUS uploads can trigger a...

EUVD-2026-65536

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...