598504 matches found
CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...
[R1] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities
R1 Security Center Version 6.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/13/2026 - 10:35 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components curl, underscoreJS were found to contain vulnerabilities, and updated...
CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CVE-2026-53784
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
EUVD-2026-58091
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CVE-2026-53784
CVE-2026-53784 affects rsync before 3.5.0. A path traversal vulnerability arises when use of chroot is disabled and the module root path (or a component) is a symlink. At session init, rsync calls chdir() to the module root without resolving symlinks (realpath or equivalent), causing subsequent r...
CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...
CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...
EUVD-2026-58087
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509
OpenList CVE-2026-73509 affects the batch_rename path: before 4.2.4, the /api/fs/batch_rename handler validates only the destination and a subset of the source directory, but does not validate attacker-controlled renameObject.SrcName. An authenticated user with rename permission can inject traver...
CVE-2026-73349
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73353
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...
CVE-2026-73401
Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...
CVE-2026-73403
Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...
CVE-2026-73344
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-67990
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...