CVE-2026-70458

A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior. Mitigation...

CVE-2026-70458

rsync 3.0.0–3.4.x are affected by an out-of-bounds write caused by incorrect HLINK_BUMP handling for file entries with FLAG_HLINKED when hard-link preservation is disabled. The issue stems from a missing F_SUM field in the file_struct layout, allowing memory corruption past the end of the allocat...

CVE-2026-70458 rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

EUVD-2026-58046

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

CVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

CVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

PT-2026-71658

Name of the Vulnerable Software and Affected Versions rsync versions 3.0.0 through 3.4.x Description An out-of-bounds write occurs when triggering HLINK BUMP processing on file entries that have the FLAG HLINKED flag set while the hard-link preservation option is inactive. This happens because th...

CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-14553

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

CVE-2026-67355

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...

Preserving Restored InterSystems IRIS Data Before Removing a Storage System

Article Applicability This article expands on the following note from Epic EHR System Protection Restoring from Storage Snapshot in the Veeam Backup & Replication User Guide: Before you start the restore wizard, create an auxiliary host for the LUN mount in the storage system interface, using any...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

EUVD-2026-51573

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...

PT-2026-66832

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

Security update for yq (important)

openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21500-1 Rating: important References: bsc1267199 bsc1271994 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...

OPENSUSE-SU-2026:21500-1 Security update for yq

This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix:...

SUSE SLES15 Security Update : yq (SUSE-SU-2026:3327-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3327-1 advisory. Update to v4.53.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass a...

SUSE-SU-2026:3327-1 Security update for yq

This update for yq fixes the following issues: Update to v4.53.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1267199. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...

OPENSUSE-SU-2026:21454-1 Security update for yq

This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix:...

Linux Distros Unpatched Vulnerability : CVE-2026-64392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available...