CVE-2026-70455

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

CVE-2026-53784

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-69184

GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains...

CVE-2026-73146

GHSA-r2gm-p682-3mpm: svxreflector: use-after-free via reentrant client deletion...

CVE-2026-52055

mgdertotlv long-form DER length OOB read...

CVE-2026-52047

w5100rx wraparound RX path copies n instead of r bytes...

CVE-2026-52076

cywspitx SPI alignment padding indexes uint32t buffer with byte offset...

CVE-2026-52058

mgdertotlv long-form DER length OOB read...

CVE-2026-52050

precomputeslidewindow NULL deref on OOM / morecomps NULL deref after failed calloc / biinitialize / alloc NULL deref on OOM...

CVE-2026-52072

mgtlsclientrecvhello sizet underflow in extlen bounds check / mgtlsclientrecvhello extlen fixed-offset OOB read...

CVE-2026-52056

skipchunk off-by-one OOB read in chunked HTTP CRLF check...

CVE-2026-52057

mgderfindoid unbounded recursion on constructed DER tags...

CVE-2026-52075

mgrandom rand fallback used for TLS secrets...

CVE-2026-73154

GHSA-5g48-xjmf-7p4q: StationData::setData stack overflow...

CVE-2026-73142

GHSA-5xr9-fmm8-7p8x: remotetrx NetUplink: connection object leak DoS...

CVE-2026-73147

GHSA-pc2g-2p95-4cr5: TCL command injection in reflector client...

CVE-2026-12061

Unknown description...

CVE-2026-61552

security update...

CVE-2026-52059

RSA-PSS CertificateVerify checks only 0xbc trailer...

CVE-2026-18728

A flaw was found in open-iscsi. An integer underflow vulnerability in the iscsiuio component, specifically during IPv4 Dynamic Host Configuration Protocol DHCP parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP...

CVE-2026-68452

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...

CVE-2026-52066

TLS certificate notAfter validated against hardcoded 2025-01-01 string...

CVE-2026-61550

security update...

CVE-2026-52073

ppphandleipcp attacker-controlled IPCP length -- OOB read...

CVE-2026-52071

mgtlsverifycertsignature OOB read for short ECDSA integers...

CVE-2026-52078

opendir stack overflow via wcscat on MAXPATH path...

CVE-2026-52062

NDP RA allows any value for MTU...

CVE-2026-52069

rxdhcpclient 32-bit overflow in DHCP lease millisecond conversion...

CVE-2026-52065

mgtlsclientrecvhello keyshare extension OOB read...

CVE-2026-52051

mgtlsserverrecvhello sessionidlen OOB read...

CVE-2026-73152

GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length...

CVE-2026-12072

Unknown description...

CVE-2026-73141

GHSA-xmcv-mjpv-x46q: Audio decoders: stack VLA exhaustion...

CVE-2026-73148

GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...

CVE-2026-73145

GHSA-58ph-q79f-7x9x: HTTP server: unbounded request accumulation...

CVE-2026-73143

GHSA-38fq-mrrg-8rmr: RtlTcp: malformed greeting causes daemon exit...

CVE-2026-73144

GHSA-qccg-7pw6-787v: FRN module: unbounded memory growth...

CVE-2026-73151

GHSA-x5r8-rq62-q9cj: remotetrx: unvalidated audio length + exposed transceiver control...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-68453

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-53789

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...