Permalink CVE-2026-19930

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored reference https://g… 6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub an hour ago

Dolibarr User Cloning card.php ldap injection

• VDB-390181 | Dolibarr User Cloning card.php ldap injection technical-descriptionvdb-entry
• VDB-390181 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-19930 | CVE Analysis and Report third-party-advisory
• Submit #872355 | dolibarr erp 23.0.3 Full Admin Takeover via User Clone Privilege Escalation third-party-advisory
• https://github.com/Dolibarr/dolibarr/issues/39000 issue-tracking
• https://drive.google.com/file/d/1tI3kUdqocvdQwQtqOi5zCFmTMm6eA3sF/view exploit
• https://github.com/Dolibarr/dolibarr/commit/798e65356ede03c2812ab1a728f23fae34d… patch

Ignored references (1)

• https://github.com/Dolibarr/dolibarr/ product

---

Dolibarr

• ==23.0.2
• ==23.0.3
• ==23.0.1
• ==23.0.0

Permalink CVE-2026-72887

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

• https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-jh72-4qq2-8j6g vendor-advisory
• https://metacpan.org/release/RRWO/Net-OAuth-0.32/changes release-notes
• https://github.com/vurtdev/Net-OAuth/commit/fd505dac1988723ed96721657663f2e4ac7… patch
• https://datatracker.ietf.org/doc/html/rfc5849#section-2.1 technical-description
• https://datatracker.ietf.org/doc/html/rfc5849#section-2.3 technical-description
• http://www.openwall.com/lists/oss-security/2026/08/16/3

---

Net-OAuth

• <0.32

Permalink CVE-2026-72888

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require

• https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-m2cv-cq5x-47ph vendor-advisory
• https://github.com/vurtdev/Net-OAuth/commit/ee713fc96263c70b3b9a5280612618b4745… patch
• https://metacpan.org/release/RRWO/Net-OAuth-0.32/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/08/16/4

---

Net-OAuth

• <0.32

Permalink CVE-2026-13002

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored package prometheus-dnsmasq-exporter 2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 6 hours ago

Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing

• https://access.redhat.com/security/cve/CVE-2026-13002 vdb-entryx_refsource_REDHAT
• RHBZ#2486360 issue-trackingx_refsource_REDHAT

---

rhcos

dnsmasq

Permalink CVE-2026-49989

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  7 packages

  • crate2nix
  • crates-lsp
  • crates-tui
  • protoc-gen-prost-crate
  • python313Packages.crate
  • python314Packages.crate
  • vscode-extensions.serayuzgur.crates
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 6 hours ago

CrateDB's Blob HTTP handler bypasses authorization

• https://github.com/crate/crate/security/advisories/GHSA-2xv8-gjwh-fv8p x_refsource_CONFIRMexploit

---

crate

• ==>= 6.3.0, < 6.3.2
• ==< 6.2.8

Permalink CVE-2026-46439

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 6 hours ago

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

• https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-gg2g-p7xc-qqmm x_refsource_CONFIRMexploit
• https://github.com/oscal-compass/compliance-trestle/commit/247fcce289f60103f3d8e28d8ec51a6986b94fb6 x_refsource_MISC
• https://github.com/oscal-compass/compliance-trestle/commit/7d107b3ac53caca7bde97a6278b23cd739d94525 x_refsource_MISC
• https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2425.yaml x_refsource_MISC

---

compliance-trestle

• ==>= 4.0.0, < 4.0.3
• ==< 3.12.2

Permalink CVE-2026-53793

9.1 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  5 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse ignored
  13 packages

  • librsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • diskrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @leona-ya
  • @balsoft
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

• GitHub Security Advisory (GHSA-wj7w-vh23-mm44) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70461

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored package grsync 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  17 packages

  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @andir
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

• GitHub Security Advisory (GHSA-jhxm-j4mq-3fj4) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-f… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53797

5.7 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Symlink Race Condition Information Disclosure

• GitHub Security Advisory (GHSA-3jj3-qvc7-jp6x) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-d… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53800

5.7 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python314Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python313Packages.sysrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @leona-ya
  • @balsoft
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Symlink Race Condition via --remove-source-files

• GitHub Security Advisory (GHSA-v3vw-pvpg-chwh) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-so… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70463

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @andir
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

• GitHub Security Advisory (GHSA-pfj8-79vq-xgvr)

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53785

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

• GitHub Security Advisory (GHSA-pph3-7xmf-rrqg) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-rela… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53790

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Command Injection via Multiple Code Paths

• GitHub Security Advisory (GHSA-5hcf-7xxm-rmqq) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53795

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • grsync
  • rrsync
  • rsyncy
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @leona-ya
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

• GitHub Security Advisory (GHSA-m9vj-637x-v6pq) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-li… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53788

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  11 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse ignored
  7 packages

  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

• GitHub Security Advisory (GHSA-p4c5-8c68-5fjq) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53796

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @andir
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

• GitHub Security Advisory (GHSA-w75h-ccff-w53m) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-toctou-race-condition-via-destinatio… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70459

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.btrsync
  • python313Packages.btrsync
  • sqlite-rsync
  • openrsync
  • diskrsync
  • parsync
  • rsyncy
  • rrsync
  • grsync
  • yaziPlugins.rsync
  • vdirsyncer
  • lazyrsync
  • librsync
  • btrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

• GitHub Security Advisory (GHSA-p4v4-qxw9-q72m) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53794

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @leona-ya
  • @pyrox0
  • @balsoft
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

• GitHub Security Advisory (GHSA-p827-vwcp-m964) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-lo… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70455

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @andir
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

• GitHub Security Advisory (GHSA-rjvj-qgqg-cvx9) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thr… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53792

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @pyrox0
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

• GitHub Security Advisory (GHSA-cg57-rp9g-56hw) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-c… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53783

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @leona-ya
  • @pyrox0
  • @balsoft
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

• GitHub Security Advisory (GHSA-9cgc-64g4-3gv5) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-esca… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70464

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @leona-ya
  • @balsoft
  • @pyrox0
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

• GitHub Security Advisory (GHSA-hrwq-ccf7-rw5m) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-h… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53784

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @leona-ya
  • @balsoft
  • @andir
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Path Traversal via Symlink Module Root

• GitHub Security Advisory (GHSA-ffg2-fr5g-3rxw) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-ro… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70454

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @leona-ya
  • @balsoft
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

• GitHub Security Advisory (GHSA-3c3x-ww2w-5r5p) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-vi… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53786

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  • sqlite-rsync
  • vdirsyncer
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • rrsync
  • grsync
  • openrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored maintainer @andir 2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  3 maintainers

  • @balsoft
  • @pyrox0
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

• GitHub Security Advisory (GHSA-mrc3-6cwx-hch6) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70453

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  • grsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @leona-ya
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()

• GitHub Security Advisory (GHSA-8x5r-mjx8-83hv) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53803

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  4 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  14 packages

  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @andir
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

• GitHub Security Advisory (GHSA-g9f4-7q66-9582) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-ove… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53791

9.1 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

• GitHub Security Advisory (GHSA-h2q9-5fr8-w635) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protoco… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53799

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored package grsync 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  17 packages

  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

• GitHub Security Advisory (GHSA-phxh-hjqv-39c9) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-acl-xattr… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53789

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @leona-ya
  • @andir
  • @balsoft
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

• GitHub Security Advisory (GHSA-fxwg-7hmf-xh5q) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-maliciou… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70456

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

• GitHub Security Advisory (GHSA-78jc-79jv-v6rw) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-ar… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70460

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

• GitHub Security Advisory (GHSA-w3xf-j2r2-gv4x) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backu… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70458

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  2 packages

  • grsync
  • rrsync
  2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  16 packages

  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • rsync
  2 days, 1 hour ago
• @LeSuisse restored package rsync 2 days, 1 hour ago
• @LeSuisse ignored package python314Packages.vdirsyncer 2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @pyrox0
  • @balsoft
  • @leona-ya
  • @andir
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling

• GitHub Security Advisory (GHSA-gg3m-4m9m-268h) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53801

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @leona-ya
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Symlink Race Condition Directory Traversal

• GitHub Security Advisory (GHSA-mch3-qr4p-chgm) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-tra… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70452

9.1 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @leona-ya
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

• GitHub Security Advisory (GHSA-6692-28cx-wpqq) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolu… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70457

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  15 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • rsync
  • python314Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse restored package rsync 2 days, 1 hour ago
• @LeSuisse ignored
  4 packages

  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python313Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @leona-ya
  • @balsoft
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

• GitHub Security Advisory (GHSA-pg7g-xqmr-xpfh) vendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-a… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70462

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • grsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.btrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @pyrox0
  • @leona-ya
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

• GitHub Security Advisory (GHSA-j9wh-5jmp-2m64) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-t… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53798

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • rsyncy
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.sysrsync
  • rrsync
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  2 references

  • Release Notes
  • https://www.vulncheck.com/advisories/rs…
  2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @leona-ya
  • @balsoft
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

• GitHub Security Advisory (GHSA-hx7p-3gvv-pqgv) vendor-advisory

Ignored references (2)

• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-convert… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-53802

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  18 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • lazyrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  4 maintainers

  • @andir
  • @balsoft
  • @leona-ya
  • @pyrox0
  2 days, 1 hour ago maintainer.ignore
• @LeSuisse ignored
  2 references

  • https://www.vulncheck.com/advisories/rs…
  • Release Notes
  2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

rsync < 3.5.0 Arbitrary File Read via Symlink Following

• GitHub Security Advisory (GHSA-4mfr-8jrv-49x4) exploitvendor-advisory

Ignored references (2)

• https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-foll… third-party-advisory
• Release Notes release-notes

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-47766

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  8 packages

  • nym
  • crunch
  • y-cruncher
  • speedcrunch
  • ocaml-crunch
  • ocamlPackages.crunch
  • ocamlPackages_latest.crunch
  • vscode-extensions.42crunch.vscode-openapi
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

crun follows rootfs /dev symlink while creating default devices

• https://github.com/containers/crun/security/advisories/GHSA-7vwr-4279-7gq5 x_refsource_CONFIRM
• https://github.com/containers/crun/releases/tag/1.28 x_refsource_MISC

---

crun

• ==< 1.28

Permalink CVE-2026-47191

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  17 packages

  • kakasi
  • kasasa
  • jackass
  • kasmweb
  • kassert
  • omekasy
  • gitlab-kas
  • kdePackages.kasts
  • lohit-fonts.kashmiri
  • python313Packages.pykakasi
  • python314Packages.pykakasi
  • python313Packages.kasa-crypt
  • python314Packages.kasa-crypt
  • python313Packages.python-kasa
  • python314Packages.python-kasa
  • perlPackages.MooseXMarkAsMethods
  • perl5Packages.MooseXMarkAsMethods
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

kas checks out SHA-like git branches as valid commits

• https://github.com/siemens/kas/security/advisories/GHSA-qjwp-hrq6-r26r x_refsource_CONFIRM
• https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5 x_refsource_MISC
• https://github.com/pypa/advisory-database/tree/main/vulns/kas/PYSEC-2026-2544.yaml x_refsource_MISC

---

kas

• ==< 5.3

Permalink CVE-2026-47192

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  17 packages

  • kakasi
  • kasasa
  • jackass
  • kasmweb
  • kassert
  • omekasy
  • gitlab-kas
  • kdePackages.kasts
  • lohit-fonts.kashmiri
  • python313Packages.pykakasi
  • python314Packages.pykakasi
  • python313Packages.kasa-crypt
  • python314Packages.kasa-crypt
  • python313Packages.python-kasa
  • python314Packages.python-kasa
  • perlPackages.MooseXMarkAsMethods
  • perl5Packages.MooseXMarkAsMethods
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

kas's late signature validation may allow unnoticed repository manipulations

• https://github.com/siemens/kas/security/advisories/GHSA-4vqc-wpwg-vh7j x_refsource_CONFIRM
• https://github.com/siemens/kas/security/advisories/GHSA-qjwp-hrq6-r26r x_refsource_MISC
• https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5 x_refsource_MISC
• https://github.com/siemens/kas/commit/5b2114becfc154b16ef496d24f8c2191a2297f57 x_refsource_MISC
• https://github.com/pypa/advisory-database/tree/main/vulns/kas/PYSEC-2026-2543.yaml x_refsource_MISC

---

kas

• ==>= 4.8, < 5.3

Permalink CVE-2026-73609

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

• GitHub Security Advisory (GHSA-j4ph-9xwf-wcj4) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73049

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

• GitHub Security Advisory (GHSA-p4qw-vx5p-g984) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73048

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

• GitHub Security Advisory (GHSA-f3q6-vc7q-m6h7) vendor-advisoryexploit
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73630

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

• GitHub Security Advisory (GHSA-4pjg-x8qj-33j5) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72810

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

• GitHub Security Advisory (GHSA-mw8r-mw84-88v2) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72812

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Missing Authorization via refreshBacklink

• GitHub Security Advisory (GHSA-wgwx-479j-23vq) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Missing Authorization via refreshBacklink third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-72811

9.9 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 SQL Injection via backlink search

• GitHub Security Advisory (GHSA-q2vg-7qgx-x5fc) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 SQL Injection via backlink search third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73608

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

• GitHub Security Advisory (GHSA-9cqf-hhrq-7v45) exploitvendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73607

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

• GitHub Security Advisory (GHSA-53fp-9jmv-227g) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getOutlineStorage third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73610

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via Local Storage

• GitHub Security Advisory (GHSA-xp3q-r38w-vgqm) exploitvendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Local Storage third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73606

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Information Disclosure via getRefIDs

• GitHub Security Advisory (GHSA-vg99-7gj7-2fr5) exploitvendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getRefIDs third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4

Permalink CVE-2026-73605

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

SiYuan before v3.7.4 Path Traversal via getUniqueFilename

• GitHub Security Advisory (GHSA-hf8h-97gm-4x2p) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.7.4 Path Traversal via getUniqueFilename third-party-advisory

---

siyuan

• <3.7.4
• ==3.7.4