CVE-2026-88015

A flaw was found in rclone. When rclone is configured with backend/local and links=true, it exposes symlink targets as .rclonelink objects. A remote attacker can send a crafted Range request with an unchecked positive Range start, leading to a deterministic slice-bounds panic. This issue results ...

CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone prior to 1.75.1 is affected when its local backend is configured with --links (or links=true), which exposes symlink targets as .rclonelink objects. A crafted HTTP Range request with a positive start value larger than the target string length triggers an unchecked slice in openTranslatedLi...

Linux Distros Unpatched Vulnerability : CVE-2026-88015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or...

PT-2026-89476

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

PT-2026-89696

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-70399 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-70399 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19. A patched version of the package is available...

CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM

A flaw was found in IntelR XeonR 6 processors when using IntelR TDX within System Management Mode SMM. Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This vulnerability could lead to high impact on...

CVE-2026-71376

CVE-2026-71376 is an OS command injection vulnerability in Cosminexus Component Container by Hitachi. The affected versions span a wide range: from 09-00 through 09-00-18 , 09-50 through 09-50-22 , 09-70 before 09-70-28 , 09-80 before 09-80-05 , 09-87 before 09-87-10 , 11-00 before 11-00-13 , 11-...

CVE-2026-86432

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausti...

UBUNTU-CVE-2026-86428

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

UBUNTU-CVE-2026-86429

The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...

UBUNTU-CVE-2026-86435

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

CVE-2026-86434

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...