Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2441
published 22 hours ago
rsync: security issues < 3.5.0 (part 2)
Permalink CVE-2026-53793
9.1 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    5 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    13 packages
    • librsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • diskrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @leona-ya
    • @balsoft
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70461
8.8 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored package grsync 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    17 packages
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @andir
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53797
5.7 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Symlink Race Condition Information Disclosure

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53800
5.7 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python314Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python313Packages.sysrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @leona-ya
    • @balsoft
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Symlink Race Condition via --remove-source-files

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70463
8.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @andir
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53785
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53790
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Command Injection via Multiple Code Paths

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53795
7.2 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • grsync
    • rrsync
    • rsyncy
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @leona-ya
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53788
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    11 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    7 packages
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53796
5.8 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @andir
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70459
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    • python313Packages.sysrsync
    • python314Packages.btrsync
    • python313Packages.btrsync
    • sqlite-rsync
    • openrsync
    • diskrsync
    • parsync
    • rsyncy
    • rrsync
    • grsync
    • yaziPlugins.rsync
    • vdirsyncer
    • lazyrsync
    • librsync
    • btrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53794
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @leona-ya
    • @pyrox0
    • @balsoft
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

rsync
  • ==3.5.0
  • =<3.4.4
NIXPKGS-2026-2440
published 22 hours ago
rsync: security issues < 3.5.0 (part 1)
Permalink CVE-2026-70455
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @andir
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53792
7.1 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @pyrox0
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53783
8.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @leona-ya
    • @pyrox0
    • @balsoft
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70464
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @leona-ya
    • @balsoft
    • @pyrox0
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53784
8.4 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @leona-ya
    • @balsoft
    • @andir
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70454
7.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @leona-ya
    • @balsoft
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53786
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    • sqlite-rsync
    • vdirsyncer
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • rrsync
    • grsync
    • openrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored maintainer @andir 22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    3 maintainers
    • @balsoft
    • @pyrox0
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70453
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    • grsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @leona-ya
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53803
8.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    4 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    14 packages
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @andir
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53791
9.1 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53799
7.2 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored package grsync 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    17 packages
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53789
7.1 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @leona-ya
    • @andir
    • @balsoft
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70456
8.8 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70460
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70458
8.8 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    2 packages
    • grsync
    • rrsync
    22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    16 packages
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • rsync
    22 hours ago
  • @LeSuisse restored package rsync 22 hours ago
  • @LeSuisse ignored package python314Packages.vdirsyncer 22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @pyrox0
    • @balsoft
    • @leona-ya
    • @andir
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53801
8.2 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @leona-ya
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Symlink Race Condition Directory Traversal

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70452
9.1 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @leona-ya
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70457
8.3 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    15 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • rsync
    • python314Packages.vdirsyncer
    22 hours ago
  • @LeSuisse restored package rsync 22 hours ago
  • @LeSuisse ignored
    4 packages
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python313Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @leona-ya
    • @balsoft
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-70462
7.1 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • grsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    • python313Packages.sysrsync
    • python314Packages.btrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @pyrox0
    • @leona-ya
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53798
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • rsyncy
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.sysrsync
    • rrsync
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @leona-ya
    • @balsoft
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync
  • ==3.5.0
  • =<3.4.4
Permalink CVE-2026-53802
8.4 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    18 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • lazyrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python314Packages.vdirsyncer
    • python313Packages.vdirsyncer
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse ignored
    4 maintainers
    • @andir
    • @balsoft
    • @leona-ya
    • @pyrox0
    22 hours ago maintainer.ignore
  • @LeSuisse ignored
    2 references
    22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

rsync < 3.5.0 Arbitrary File Read via Symlink Following

rsync
  • ==3.5.0
  • =<3.4.4
NIXPKGS-2026-2439
published 22 hours ago
crun follows rootfs /dev symlink while creating default devices
Permalink CVE-2026-47766
5.1 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse ignored
    8 packages
    • nym
    • crunch
    • y-cruncher
    • speedcrunch
    • ocaml-crunch
    • ocamlPackages.crunch
    • ocamlPackages_latest.crunch
    • vscode-extensions.42crunch.vscode-openapi
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

crun follows rootfs /dev symlink while creating default devices

crun
  • ==< 1.28
NIXPKGS-2026-2438
published 22 hours ago
kas: security issues < 5.4
Permalink CVE-2026-47191
2.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse ignored
    17 packages
    • kakasi
    • kasasa
    • jackass
    • kasmweb
    • kassert
    • omekasy
    • gitlab-kas
    • kdePackages.kasts
    • lohit-fonts.kashmiri
    • python313Packages.pykakasi
    • python314Packages.pykakasi
    • python313Packages.kasa-crypt
    • python314Packages.kasa-crypt
    • python313Packages.python-kasa
    • python314Packages.python-kasa
    • perlPackages.MooseXMarkAsMethods
    • perl5Packages.MooseXMarkAsMethods
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

kas checks out SHA-like git branches as valid commits

kas
  • ==< 5.3
Permalink CVE-2026-47192
2.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse ignored
    17 packages
    • kakasi
    • kasasa
    • jackass
    • kasmweb
    • kassert
    • omekasy
    • gitlab-kas
    • kdePackages.kasts
    • lohit-fonts.kashmiri
    • python313Packages.pykakasi
    • python314Packages.pykakasi
    • python313Packages.kasa-crypt
    • python314Packages.kasa-crypt
    • python313Packages.python-kasa
    • python314Packages.python-kasa
    • perlPackages.MooseXMarkAsMethods
    • perl5Packages.MooseXMarkAsMethods
    22 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

kas's late signature validation may allow unnoticed repository manipulations

kas
  • ==>= 4.8, < 5.3
NIXPKGS-2026-2437
published 22 hours ago
siyuan: security issues < 3.7.4
Permalink CVE-2026-73609
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73049
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73048
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73630
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-72810
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-72812
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Missing Authorization via refreshBacklink

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-72811
9.9 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 SQL Injection via backlink search

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73608
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73607
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73610
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via Local Storage

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73606
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Information Disclosure via getRefIDs

siyuan
  • <3.7.4
  • ==3.7.4
Permalink CVE-2026-73605
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

SiYuan before v3.7.4 Path Traversal via getUniqueFilename

siyuan
  • <3.7.4
  • ==3.7.4
NIXPKGS-2026-2436
published 22 hours ago
limesurvey: security issues <= 7.0.5
Permalink CVE-2026-18403
6.0 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse ignored reference https://g… 23 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB

LimeSurvey
  • ==7.0.5
Permalink CVE-2026-63361
8.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 22 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse ignored reference https://g… 23 hours ago
  • @LeSuisse accepted 22 hours ago
  • @LeSuisse published on GitHub 22 hours ago

LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

LimeSurvey
  • ==7.0.5
NIXPKGS-2026-2435
published 23 hours ago
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Permalink CVE-2026-48702
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 23 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored
    3 packages
    • python313Packages.sigstore-rekor-types
    • python314Packages.sigstore-rekor-types
    • rekor-cli
    23 hours ago
  • @LeSuisse accepted 23 hours ago
  • @LeSuisse published on GitHub 23 hours ago

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

rekor
  • ==>= 0.3.0, < 1.5.2 
Needs backport
NIXPKGS-2026-2434
published 23 hours ago
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
Permalink CVE-2026-49478
8.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 23 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse accepted 23 hours ago
  • @LeSuisse published on GitHub 23 hours ago

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

fulcio
  • ==< 1.8.6 
Needs backport
NIXPKGS-2026-2433
published 3 days, 5 hours ago
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
Permalink CVE-2026-73501
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 3 days, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse accepted 3 days, 7 hours ago
  • @LeSuisse published on GitHub 3 days, 5 hours ago

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi
  • ==< 0.144.0
NIXPKGS-2026-2432
published 3 days, 5 hours ago
Incorrect Privilege Assignment in GitLab
Permalink CVE-2025-9486
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 3 days, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse ignored
    40 packages
    • gitlab-art
    • gitlab-duo
    • gitlab-kas
    • gitlab-ci-ls
    • gitlab-pages
    • gitlab-shell
    • danger-gitlab
    • gitlab-clippy
    • gitlab-runner
    • gitlab-triage
    • gitlab-ci-local
    • gitlab-timelogs
    • gitlab-ci-linter
    • gitlab-workhorse
    • gitlab-ci-validate
    • gitlab-release-cli
    • ocamlPackages.gitlab
    • gitlab-container-registry
    • ocamlPackages.gitlab-jsoo
    • ocamlPackages.gitlab-unix
    • rubyPackages.gitlab-markup
    • terraform-providers.gitlab
    • ocamlPackages_latest.gitlab
    • gitlab-elasticsearch-indexer
    • haskellPackages.gitlab-haskell
    • rubyPackages_3_3.gitlab-markup
    • rubyPackages_3_4.gitlab-markup
    • rubyPackages_4_0.gitlab-markup
    • python313Packages.mkdocs-gitlab
    • python313Packages.python-gitlab
    • python314Packages.mkdocs-gitlab
    • python314Packages.python-gitlab
    • ocamlPackages_latest.gitlab-jsoo
    • ocamlPackages_latest.gitlab-unix
    • terraform-providers.gitlabhq_gitlab
    • gnomeExtensions.gitlab-time-tracking
    • prometheus-gitlab-ci-pipelines-exporter
    • vscode-extensions.gitlab.gitlab-workflow
    • perlPackages.AlienBuildPluginDownloadGitLab
    • perl5Packages.AlienBuildPluginDownloadGitLab
    3 days, 7 hours ago
  • @LeSuisse accepted 3 days, 7 hours ago
  • @LeSuisse published on GitHub 3 days, 5 hours ago

Incorrect Privilege Assignment in GitLab

GitLab
  • <19.1.4
  • <19.2.2
  • <19.0.6