CVE-2026-108762

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

EUVD-2026-104140

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

CVE-2026-108762

A path-confinement bypass vulnerability exists in Apache Kylin versions 4.0.0 through 5.0.4 during the deletion of metadata backups. This flaw primarily impacts services directly exposed to the public network, while in-house deployments are less likely to be affected. To remediate this issue, use...

CVE-2026-108762 Apache Kylin: delete metadata backup path-confinement bypass

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

CVE-2026-108762: Undefined Security Weakness

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

EUVD-2026-102852

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-63619 Apache Kylin: Missing authorization and path-confinement on system meta dump

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-63619

Apache Kylin versions 4 through 5.0.4 are affected by a Missing Authorization vulnerability (CWE-862). A backend metadata dump API lacks sufficient authorization and path-confinement, potentially allowing unauthorized access to metadata. The impact is highest for services directly exposed to the ...

CVE-2026-63619: Missing Authorization

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

PT-2026-115601

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description A missing authorization and path-confinement issue exists in a backend metadata dump API. This flaw primarily impacts services directly exposed to the public network, while in-house deployments...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130120 advisory. rsync before 3.5.0contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791331932)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791331932 advisory. - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands...

CLSA-2026-1790925399 rsync: Fix of 5 CVEs

CVE-2026-53793: widen the daemon path-confinement gate to cover a chrooted module whose path carries a "/./" inner boundary marker, and route the resolver trust root and domkdirat through the same predicate - CVE-2026-53796: confine the non-daemon receiver's destination chdir, refusing a...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789749013)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1789749013 advisory. - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands...

rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789786148)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789786148 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

CVE-2026-89258

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, who can place a symbolic link symlink in a mounted directory, to bypass path confinement. This bypass enables functions performing direct resource lookups to follow the symlink and read files outside the...

CVE-2026-85706

Laboratorio de validación de CVE-2026-85706 en GitLab Este directorio construye un laboratorio de GitLab aislado y exclusivamente local para pruebas defensivas autorizadas de CVE-2026-85706. El CVE afecta la API repository-commits de GitLab CE/EE en el confinamiento de rutas y la aplicación de...