Security update for rsync

This update for rsync fixes the following issues: CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. CVE-2026-53785: --relative implied-parent creation...

CVE-2026-53786

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...

EUVD-2013-6918

Malware in sbrugna...

MAL-2025-37585 Malicious code in uglify-validate-daemon-emulate-module (npm)

The package uglify-validate-daemon-emulate-module was found to contain malicious code...

The vulnerability of the httpd module of the microprogramming system used in Tenda AC18 routers allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the httpd microprogramming system in the Tenda AC18 router lies in the writing beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2022-30476

Tenda AC Series Router AC18V15.03.05.196318 was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetFirewallCfg request...

CVE-2013-7135

The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file...