CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

PT-2026-71639

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's directory scanning logic. This occurs when an attacker manipulates symlinks in a path component of the scanned tree, replacing a symlink with a directory...

PT-2026-75963

GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...

PT-2026-71607

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

The vulnerability of the Linux operating system’s kernel Bluetooth module, allowing a hacker to trigger a service failure

The vulnerability of the Linux operating system’s kernel Bluetooth module is related to premature resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-71625

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Authenticated clients can bypass module-level filter restrictions by providing malicious --filter merge file directives. During filter evaluation, attackers can inject client-side merge file directives...

PT-2026-71664

Name of the Vulnerable Software and Affected Versions rsync daemon versions 2.0.0 through 3.4.9 Description A denial of service issue exists that allows unauthenticated remote attackers to exhaust daemon connection slots. This is achieved by stalling the handshake process either before or after...

Linux Distros Unpatched Vulnerability : CVE-2026-18727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

PT-2026-71649

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below...

Vulnerability in contrib module (CVE-2026-14678)

PostgreSQL pgtrgm picksplit reads past end of buffer Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5,...

Vulnerability in contrib module (CVE-2026-14676)

PostgreSQL pgstatstatements heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3593-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3593-1 advisory. The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues: The following security issues were fixed: -...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3595-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3595-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: -...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

SUSE SLED15: libxmlrpc++8 / libxmlrpc3 / libxmlrpc_abyss++8 / libxmlrpc_abyss3 / etc (SUSE-SU-2026:3572-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3572-1 advisory. This update for xmlrpc-c fixes the following issue: - CVE-2026-15928: reflected cross-site scripting XSS via HTML...

SUSE SLES15 Security Update : erlang26 (SUSE-SU-2026:3579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3579-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...