Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.0	CVE-2026-116196	Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... rclone, Backblazerclone, Backblaze B2	NVD	Oct 25 14:17 UTC
CVE-2026-116196Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... Executive summary Rclone, an open-source tool for copying and syncing files to cloud storage, has a credential exposure flaw in its Backblaze B2 backend. When a custom download host is configured, the live account authorization token and SSE-C encryption keys can be sent over cleartext or to another host during an HTTP redirect, and the advisory rates it Moderate with a CVSS 3.1 base score of 5.3. The advisory says the fix is to update to v1.75.2, with workarounds that include enforcing HTTPS on the download URL and using least-privilege application keys. Technical summary This is a cleartext transmission of sensitive information issue (CWE-319) in the rclone b2 backend, where the default Go HTTP client follows redirects from the custom --b2-download-url host. A same-host HTTPS-to-HTTP redirect causes the Authorization header to be resent in cleartext, and the SSE-C customer key headers are forwarded to any redirect target host. The advisory lists rclone versions before v1.75.2 and states affected versions as <= v1.75.0 with patched version v1.75.2. The attack vector is Adjacent with high complexity, no privileges or user interaction required, and CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The Remediation section says to update to v1.75.1, which conflicts with the patched version v1.75.2 listed elsewhere in the advisory. Workarounds are to enforce an explicit https:// scheme on --b2-download-url, block plaintext redirects at the CDN, unset the download URL, and use scoped application keys. No CVE identifier is stated in the advisory, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone Backblaze rclone Backblaze B2 NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-116195	Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... rclone, github.com/rclone/rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116195Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... Executive summary A flaw in the rclone file sync tool lets an attacker who can create a specially named directory in the source tree change ownership and timestamps of a directory outside the destination the operator chose. The advisory rates it Moderate, with a CVSS score of 7.4 for the root-run case and a conservative estimate of about 6.8. The advisory recommends fixing the trimming logic so the name is checked after trimming, and it notes the affected versions are 1.75.1 and earlier, with 1.75.2 as the patched version. Technical summary This is a path traversal (CWE-22, CWE-59) in rclone's local backend, where translateLink trims the .rclonelink suffix from the OS path after the containment check, so validated paths can be shifted one directory up. It requires a local destination with -l and --metadata, and an attacker who can create a directory named .rclonelink in the copied tree. The advisory reports the escape affects metadata only (ownership, timestamps, xattrs) because content writes are blocked by os.Root hardening, and that a root-run case allows ownership change. It lists affected versions as <= 1.75.1 and patched version 1.75.2, but also states that v1.75.0 and master HEAD 4479a3b are affected by its own testing. The suggested fix is to trim the remote name before confinement and re-validate the final path. The advisory does not state a workaround, and it does not state any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone github.com/rclone/rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116194	Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... rclone, pCloudrclone, pCloud backend	NVD	Oct 25 14:16 UTC
CVE-2026-116194Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... Executive summary Rclone versions from 1.52.0 before 1.75.2 contain a cross-site request forgery flaw in the pCloud backend's localhost OAuth setup callback. A malicious web page open in a user's browser during the pCloud authorization flow can silently point the user's pCloud remote at an attacker-controlled host, causing later file transfers to go to that host. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is to upgrade to v1.75.2. Technical summary The flaw is a missing state check (CWE-352 cross-site request forgery) on rclone's localhost OAuth callback at 127.0.0.1:53682 for the pCloud backend, combined with trust in an unauthenticated hostname parameter (CWE-346). An attacker needs a victim to load a malicious page while rclone config or rclone authorize pcloud is running, and the advisory notes Chrome Private Network Access can block subresource requests while top-level navigation is not blocked. Affected versions are stated as >= 1.52.0 and <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround. Detection guidance beyond the proof of concept is not stated, and no CVE identifier is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone pCloud rclone pCloud backend NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116193	Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116193Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests Executive summary The advisory says rclone, an open-source file synchronization tool, has an authentication bypass in its serve webdav feature affecting versions from 1.64.0 before 1.75.2. An unauthenticated remote attacker can learn whether arbitrary paths exist and whether they are files or folders, though file contents and writes are not reachable. The advisory rates it Moderate with a CVSS v3 base score of 5.3 and recommends upgrading to 1.75.2. Technical summary The flaw is missing authentication (CWE-306) caused by the basicAuth and MiddlewareAuthCustom HTTP middlewares in lib/http skipping all OPTIONS requests rather than only genuine CORS preflights. An unauthenticated network attacker can send OPTIONS requests to rclone serve webdav and read the Allow header, which differs for existing files, existing collections, and missing paths, enabling namespace enumeration. The advisory states the affected range as >= 1.64.0 and <= 1.75.1, with patched version 1.75.2. No workaround is stated. The advisory does not state whether the issue is exploited in the wild, and it gives no detection guidance beyond the proof of concept. The advisory says rclone serve http and other listed servers are not affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116192	rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... Executive summary Rclone versions from 1.37 before 1.74.2 contain a server-side request forgery flaw that lets unauthenticated attackers, when the optional --rc-serve feature is enabled without RC authentication, redirect HTTP and NetStorage backend requests to hosts they choose. The advisory rates it Moderate with a recommended CVSS 3.1 score of 5.9. The vendor-side fix is to upgrade to version 1.74.2, which the advisory lists as the patched version. Technical summary This is a server-side request forgery (CWE-918) caused by a scheme-relative named-remote root, such as //host/path, that replaces the configured URL authority for the http and netstorage backends. Exploitation requires --rc-serve enabled, no RC HTTP authentication, a reachable RC listener, and knowledge of an existing http or netstorage remote name; the advisory notes the default bind is loopback and that --rc-no-auth is not set in the tested configuration. Affected versions are stated as 1.37 or later up to and including 1.74.1, with patched version 1.74.2. The advisory says the attacker can cause same-scheme HEAD and GET requests to attacker-selected hosts with response bodies returned, send configured HTTP headers to those hosts, and obtain time-bound NetStorage signatures, but no write primitive is demonstrated. A proposed origin-check patch is described, but the advisory does not state a workaround, and no detection guidance is given. Whether the issue is exploited in the wild is not stated, and no CVE identifier is listed on the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116191	Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... rclone, ncwrclone, ncw rclone	NVD	Oct 25 14:16 UTC
CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... Executive summary Rclone versions before 1.75.2 contain a path traversal flaw in its WebDAV server (rclone serve webdav) that lets an unauthenticated remote client create, overwrite, and move files and directories above the folder that rclone is configured to serve. The advisory rates it High with a CVSS 3.1 base score of 7.5, and it describes the impact as integrity and availability rather than data disclosure. The vendor's fix is upgrading to version 1.75.2. Technical summary The flaw is a CWE-22 path traversal caused by unvalidated '..' path elements in WebDAV requests, such as MKCOL /. which plants a directory node whose backend path is '..'. The attack needs no authentication, which the advisory says is the default for rclone serve webdav, and requires two HTTP requests (an MKCOL followed by a PUT). The advisory says it applies when the served remote has a non-empty root and the backend joins root and remote before encoding, such as webdav, ftp, sftp, http, or memory, and that local and s3 backends are not affected. Affected versions are stated as <= 1.75.1 and the patched version as 1.75.2; the advisory says the lower bound is not established. Workarounds stated: running with --read-only blocks the attack (the advisory reports MKCOL returning 405), and the advisory proposes code fixes that add path checks. Detection guidance beyond the proof-of-concept request sequence is not stated, and no CVE identifier is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116190	rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116190rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... Executive summary The rclone tool's WebDAV backend can send a custom credential header to a different host when the configured WebDAV server issues a cross-host redirect, which could expose a reusable login credential. The advisory rates it Low, with a CVSS 3.7 score and a note that no CVE is assigned. The advisory states that affected versions are v1.56.0 through v1.75.1 and that v1.75.2 is the patched version. Technical summary This is an information disclosure flaw, classified as CWE-200 and CWE-522, in which operator-configured custom headers set via the WebDAV headers option are re-sent on cross-host HTTP 3xx redirects. Exploitation requires that an attacker can influence the server's redirect response, such as through an open redirect, a malicious or compromised endpoint, or an on-path position on a cleartext or same-host hop. The advisory states the fixed version is v1.75.2 and that the default configuration is affected, independent of the auth_redirect option. Standard Authorization headers are stripped by Go across registrable domains, but custom-named headers are not. The advisory does not state a workaround beyond avoiding reusable secret headers on remotes that may redirect to other hosts, and it does not state any detection guidance or known exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.7	CVE-2026-116189	rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116189rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... Executive summary A flaw in the stable self-update feature of rclone, a command-line file sync tool, lets an attacker who already controls the trusted release download path install a malicious replacement program, affecting versions 1.55.0 through 1.75.1. The advisory rates the issue High, with a CVSS 3.1 score of 7.5. The advisory recommends applying the proposed fix, which resolves the checksum only from the signed portion of the response, but it states that no upstream fixed release was available at the time of testing and the listed patched version is 1.75.2. Technical summary The vulnerability is an improper verification of a cryptographic signature (CWE-347). The verifier checks a PGP clearsigned SHA256SUMS block but then looks up the archive hash in the original response buffer, which can include unsigned bytes before the signed block, so an attacker-supplied unsigned checksum line is accepted. The attack requires control of authenticated responses from the stable release distribution path, such as origin, CDN, or TLS termination compromise, or interception with a trusted certificate, and user interaction in running stable selfupdate without --check. Affected versions are stated as >= 1.55.0 and <= 1.75.1, with patched version 1.75.2. The advisory states a proposed fix of resolving the hash from block.Bytes, which was tested but is not described as shipped upstream. Workarounds are not stated. Detection guidance beyond the proof-of-concept test is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116188	rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116188rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit Executive summary The advisory says rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow that lets an unauthenticated network client bypass the configured memory limit for multipart uploads, which can exhaust memory on the host running the service. The severity is rated Moderate, and the advisory lists 1.75.2 as the patched version. Users should upgrade to 1.75.2 or later. Technical summary This is an integer overflow (CWE-190) combined with unbounded resource allocation (CWE-770) in the multipart reorder-memory accounting of rclone serve s3. An attacker who can reach the S3 listener opens two concurrent multipart PUT requests for the current part, each declaring 5,000,000,000,000,000,000 bytes, and withholds the bodies, so the signed int64 accounting field wraps negative and out-of-order parts later pass the capacity check. The advisory says affected versions are 1.75.0 up to but not including 1.75.2, with the patched version listed as 1.75.2. Exploitation needs no credentials when serve s3 runs without --auth-key or --auth-proxy, and authenticated deployments require an accepted S3 credential. The advisory states that no workaround is available beyond binding to a trusted interface, which it says does not fix the arithmetic, and that disabling streaming is not a safe mitigation. Detection guidance is not stated, and the CVSS v3.1 base vector given is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with an overall score shown as 5.3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-qjw8-8hmp-c3m6 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.1	CVE-2026-116187	Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116187Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... Executive summary Rclone versions from v1.68.0 before v1.75.2 contain an authorization bypass in its S3 server when run with --auth-proxy, letting one authenticated tenant interfere with another tenant's in-flight multipart uploads. The advisory rates it Moderate with a CVSS score of 6.4, and the recommended fix is to upgrade to v1.75.2. Technical summary The flaw is CWE-639, an authorization bypass through a user-controlled key. The multipart operations UploadPart, CompleteMultipartUpload and AbortMultipartUpload look up uploads by upload ID alone and do not check the caller's tenant, so a tenant who learns another tenant's bucket, object and uploadID can inject data into, complete or abort that upload. The advisory says the attacker must be an authenticated tenant on a server using --auth-proxy with several keys, and must obtain the victim's tuple, which it demonstrates through ListMultipartUploads while owning a same-named bucket. Affected versions are stated as >=v1.68.0 <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround, and detection guidance is not stated. It notes that at-rest content is not read and the destination key is set by the victim at initiate. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects