CVE-2026-119741

Rsync versions through 3.5.1 are vulnerable to a Denial of Service (DoS) via checksum collisions in the delta-transfer sender's hash_search() function located in match.c . The root cause involves an Inefficient Algorithmic Complexity (CWE-407) where unauthenticated attackers pulling from a public...

CLSA-2026-1792173472 rsync: Fix of CVE-2026-70460

CVE-2026-70460: confine a peer-supplied --partial-dir and --backup-dir on a daemon module to the module root, so an in-module symlink can no longer redirect partial-file or backup reads, writes, renames and unlinks outside the module...

CLSA-2026-1789786148 rsync: Fix of 4 CVEs

CVE-2026-53793: confine a daemon module whose path carries a "/./" inner boundary marker to the inner module root rather than only to the kernel chroot, by widening the single predicate every confined wrapper, the secure symlink handling and the directory scan test, so a symlink inside the module...

CLSA-2026-1789466898 Fix of 7 CVEs

SECURITY UPDATE: symlink attack on the daemon module-root chdir - debian/patches/els/0031-CVE-2026-53784.patch: add safeopennoattackersymlinks in util.c and confine the daemon module-root chdir under use-chroot=no. els/0006 had hardened only the relative branch of changedir; the absolute branch w...

CLSA-2026-1789462227 rsync: Fix of 4 CVEs

CVE-2026-53784: resolve the daemon module-root chdir through a trusted-owner walk so a planted symlink on the module path or any parent component cannot steer the daemon outside the module under "use chroot = no" - CVE-2026-53795: confine each side of dorenameat/dolinkat independently; an...

SUSE-SU-2026:23323-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

Security update for rsync

This update for rsync fixes the following issues: CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. CVE-2026-53785: --relative implied-parent creation...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

EUVD-2013-6918

Malware in sbrugna...

MAL-2025-37585 Malicious code in uglify-validate-daemon-emulate-module (npm)

The package uglify-validate-daemon-emulate-module was found to contain malicious code...

Tenda AC18 Router httpd Module Data Compromise

The vulnerability of the httpd microprogramming system in the Tenda AC18 router lies in the writing beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2022-30476

Tenda AC Series Router AC18V15.03.05.196318 was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetFirewallCfg request...

CVE-2013-7135

The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file...