Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

145-76% vs 7-day avg of 598

2 critical, 38 high, 60 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.2	CVE-2026-116192	rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... Executive summary Rclone versions from 1.37 before 1.74.2 contain a server-side request forgery flaw that lets unauthenticated attackers, when the optional --rc-serve feature is enabled without RC authentication, redirect HTTP and NetStorage backend requests to hosts they choose. The advisory rates it Moderate with a recommended CVSS 3.1 score of 5.9. The vendor-side fix is to upgrade to version 1.74.2, which the advisory lists as the patched version. Technical summary This is a server-side request forgery (CWE-918) caused by a scheme-relative named-remote root, such as //host/path, that replaces the configured URL authority for the http and netstorage backends. Exploitation requires --rc-serve enabled, no RC HTTP authentication, a reachable RC listener, and knowledge of an existing http or netstorage remote name; the advisory notes the default bind is loopback and that --rc-no-auth is not set in the tested configuration. Affected versions are stated as 1.37 or later up to and including 1.74.1, with patched version 1.74.2. The advisory says the attacker can cause same-scheme HEAD and GET requests to attacker-selected hosts with response bodies returned, send configured HTTP headers to those hosts, and obtain time-bound NetStorage signatures, but no write primitive is demonstrated. A proposed origin-check patch is described, but the advisory does not state a workaround, and no detection guidance is given. Whether the issue is exploited in the wild is not stated, and no CVE identifier is listed on the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116191	Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... rclone, ncwrclone, ncw rclone	NVD	Oct 25 14:16 UTC
CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... Executive summary Rclone versions before 1.75.2 contain a path traversal flaw in its WebDAV server (rclone serve webdav) that lets an unauthenticated remote client create, overwrite, and move files and directories above the folder that rclone is configured to serve. The advisory rates it High with a CVSS 3.1 base score of 7.5, and it describes the impact as integrity and availability rather than data disclosure. The vendor's fix is upgrading to version 1.75.2. Technical summary The flaw is a CWE-22 path traversal caused by unvalidated '..' path elements in WebDAV requests, such as MKCOL /. which plants a directory node whose backend path is '..'. The attack needs no authentication, which the advisory says is the default for rclone serve webdav, and requires two HTTP requests (an MKCOL followed by a PUT). The advisory says it applies when the served remote has a non-empty root and the backend joins root and remote before encoding, such as webdav, ftp, sftp, http, or memory, and that local and s3 backends are not affected. Affected versions are stated as <= 1.75.1 and the patched version as 1.75.2; the advisory says the lower bound is not established. Workarounds stated: running with --read-only blocks the attack (the advisory reports MKCOL returning 405), and the advisory proposes code fixes that add path checks. Detection guidance beyond the proof-of-concept request sequence is not stated, and no CVE identifier is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.7	CVE-2026-116189	rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116189rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... Executive summary A flaw in the stable self-update feature of rclone, a command-line file sync tool, lets an attacker who already controls the trusted release download path install a malicious replacement program, affecting versions 1.55.0 through 1.75.1. The advisory rates the issue High, with a CVSS 3.1 score of 7.5. The advisory recommends applying the proposed fix, which resolves the checksum only from the signed portion of the response, but it states that no upstream fixed release was available at the time of testing and the listed patched version is 1.75.2. Technical summary The vulnerability is an improper verification of a cryptographic signature (CWE-347). The verifier checks a PGP clearsigned SHA256SUMS block but then looks up the archive hash in the original response buffer, which can include unsigned bytes before the signed block, so an attacker-supplied unsigned checksum line is accepted. The attack requires control of authenticated responses from the stable release distribution path, such as origin, CDN, or TLS termination compromise, or interception with a trusted certificate, and user interaction in running stable selfupdate without --check. Affected versions are stated as >= 1.55.0 and <= 1.75.1, with patched version 1.75.2. The advisory states a proposed fix of resolving the hash from block.Bytes, which was tested but is not described as shipped upstream. Workarounds are not stated. Detection guidance beyond the proof-of-concept test is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.1	CVE-2026-116187	Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116187Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... Executive summary Rclone versions from v1.68.0 before v1.75.2 contain an authorization bypass in its S3 server when run with --auth-proxy, letting one authenticated tenant interfere with another tenant's in-flight multipart uploads. The advisory rates it Moderate with a CVSS score of 6.4, and the recommended fix is to upgrade to v1.75.2. Technical summary The flaw is CWE-639, an authorization bypass through a user-controlled key. The multipart operations UploadPart, CompleteMultipartUpload and AbortMultipartUpload look up uploads by upload ID alone and do not check the caller's tenant, so a tenant who learns another tenant's bucket, object and uploadID can inject data into, complete or abort that upload. The advisory says the attacker must be an authenticated tenant on a server using --auth-proxy with several keys, and must obtain the victim's tuple, which it demonstrates through ListMultipartUploads while owning a same-named bucket. Affected versions are stated as >=v1.68.0 <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround, and detection guidance is not stated. It notes that at-rest content is not read and the destination key is set by the victim at initiate. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer