CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

EUVD-2026-75575

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone prior to 1.75.1 is affected when its local backend is configured with --links (or links=true), which exposes symlink targets as .rclonelink objects. A crafted HTTP Range request with a positive start value larger than the target string length triggers an unchecked slice in openTranslatedLi...

GHSA-FX5J-QCQG-GRPF Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Negative shared-string index causes panic in GetCellValue and GetRows Summary Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice. If an XLSX file contains a shared-string cell with -1, the parsed index is negative. T...

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Negative shared-string index causes panic in GetCellValue and GetRows Summary Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice. If an XLSX file contains a shared-string cell with -1, the parsed index is negative. T...

EUVD-2026-42937

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows...

kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when commands sent to the firmware FW are not properly cleared after a chip reset. A local attacker could exploit a race condition during direct memory access DMA unmapping, leading to a kernel panic. This can...

kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when commands sent to the firmware FW are not properly cleared after a chip reset. A local attacker could exploit a race condition during direct memory access DMA unmapping, leading to a kernel panic. This can...

CLEANSTART-2026-HA46232 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the metallb package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-LE73008 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the prometheus-redis-exporter package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

PT-2026-89696

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

Linux Distros Unpatched Vulnerability : CVE-2026-88015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or...

CVE-2026-88015: Integer Overflow or Wraparound

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015: Integer Overflow or Wraparound

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

PT-2026-89476

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When using backend/local with the --links flag or links=true configuration, symlink targets are exposed as .rclonelink objects. A flaw exists where fs.RangeOption.Decode can pass an unchecked positiv...

rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...

Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics

Shrinking an AlignedBox takes ownership of the buffer out of self.container with ManuallyDrop::take, destroys the elements past the new length, and only then commits the new Box back into self.container. ManuallyDrop::take moves ownership but not the bits, so until that commit self.container stil...

Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics

OwnedAlloc::dropinplace destroys the contained value by hand, then commits the ownership transfer with mem::forgetself — which lives inside intoraw and so runs only after the destruction. T::drop is user code and may panic. If it does, the forget is skipped and the still-live OwnedAlloc unwinds,...