Published issues
Dolibarr User Cloning card.php ldap injection
Permalink
CVE-2026-19930
2.1 LOW
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Exploit Maturity (E): POC (P)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
updated
an hour ago
by @LeSuisse
Activity log
-
Created suggestion
14 hours ago
-
@LeSuisse
ignored
reference https://g…
6 hours ago
-
@LeSuisse
accepted
6 hours ago
-
@LeSuisse
published on GitHub
an hour ago
Dolibarr User Cloning card.php ldap injection
Dolibarr
-
==23.0.2
-
==23.0.3
-
==23.0.1
-
==23.0.0
perl packages.NetOAuth: security issues < 0.32
updated
6 hours ago
by @LeSuisse
Activity log
-
Created suggestion
14 hours ago
-
@LeSuisse
accepted
6 hours ago
-
@LeSuisse
published on GitHub
6 hours ago
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token
updated
6 hours ago
by @LeSuisse
Activity log
-
Created suggestion
14 hours ago
-
@LeSuisse
accepted
6 hours ago
-
@LeSuisse
published on GitHub
6 hours ago
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing
Permalink
CVE-2026-13002
4.4 MEDIUM
-
CVSS version (CVSS): 3.1
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Privileges Required (PR): High (H)
-
User Interaction (UI): None (N)
-
Scope (S): Unchanged (U)
-
Confidentiality (C): None (N)
-
Integrity (I): None (N)
-
Availability (A): High (H)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Privileges Required (MPR): High (H)
-
Modified User Interaction (MUI): None (N)
-
Modified Confidentiality (MC): None (N)
-
Modified Scope (MS): Unchanged (U)
-
Modified Integrity (MI): None (N)
-
Modified Availability (MA): High (H)
updated
6 hours ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
ignored
package prometheus-dnsmasq-exporter
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
6 hours ago
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing
CrateDB's Blob HTTP handler bypasses authorization
Permalink
CVE-2026-49989
7.1 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
6 hours ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
ignored
7 packages
- crate2nix
- crates-lsp
- crates-tui
- protoc-gen-prost-crate
- python313Packages.crate
- python314Packages.crate
- vscode-extensions.serayuzgur.crates
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
6 hours ago
CrateDB's Blob HTTP handler bypasses authorization
crate
-
==>= 6.3.0, < 6.3.2
-
==< 6.2.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Permalink
CVE-2026-46439
7.8 HIGH
-
CVSS version (CVSS): 3.1
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Required (R)
-
Scope (S): Unchanged (U)
-
Confidentiality (C): High (H)
-
Integrity (I): High (H)
-
Availability (A): High (H)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Required (R)
-
Modified Confidentiality (MC): High (H)
-
Modified Scope (MS): Unchanged (U)
-
Modified Integrity (MI): High (H)
-
Modified Availability (MA): High (H)
updated
6 hours ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
6 hours ago
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
compliance-trestle
-
==>= 4.0.0, < 4.0.3
-
==< 3.12.2
rsync: security issues < 3.5.0 (part 2)
Permalink
CVE-2026-53793
9.1 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): Present (P)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): Present (P)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
5 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
13 packages
- librsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- diskrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @leona-ya
- @balsoft
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode
Permalink
CVE-2026-70461
8.8 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
package grsync
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
17 packages
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
Permalink
CVE-2026-53797
5.7 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Symlink Race Condition Information Disclosure
Permalink
CVE-2026-53800
5.7 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python313Packages.sysrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @leona-ya
- @balsoft
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Symlink Race Condition via --remove-source-files
Permalink
CVE-2026-70463
8.6 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
Permalink
CVE-2026-53785
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
Permalink
CVE-2026-53790
9.2 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Command Injection via Multiple Code Paths
Permalink
CVE-2026-53795
7.2 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- grsync
- rrsync
- rsyncy
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
Permalink
CVE-2026-53788
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
11 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
7 packages
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
Permalink
CVE-2026-53796
5.8 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
Permalink
CVE-2026-70459
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
- python313Packages.sysrsync
- python314Packages.btrsync
- python313Packages.btrsync
- sqlite-rsync
- openrsync
- diskrsync
- parsync
- rsyncy
- rrsync
- grsync
- yaziPlugins.rsync
- vdirsyncer
- lazyrsync
- librsync
- btrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
Permalink
CVE-2026-53794
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @leona-ya
- @pyrox0
- @balsoft
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
rsync: security issues < 3.5.0 (part 1)
Permalink
CVE-2026-70455
8.7 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
Permalink
CVE-2026-53792
7.1 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @pyrox0
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block
Permalink
CVE-2026-53783
8.6 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @leona-ya
- @pyrox0
- @balsoft
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
Permalink
CVE-2026-70464
8.7 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @leona-ya
- @balsoft
- @pyrox0
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
Permalink
CVE-2026-53784
8.4 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @leona-ya
- @balsoft
- @andir
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Path Traversal via Symlink Module Root
Permalink
CVE-2026-70454
7.6 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @leona-ya
- @balsoft
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode
Permalink
CVE-2026-53786
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
- sqlite-rsync
- vdirsyncer
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- rrsync
- grsync
- openrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
maintainer @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
3 maintainers
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive
Permalink
CVE-2026-70453
8.7 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
- grsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()
Permalink
CVE-2026-53803
8.5 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
4 packages
- grsync
- rrsync
- rsyncy
- btrsync
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
14 packages
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
Permalink
CVE-2026-53791
9.1 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): Present (P)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): Present (P)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
Permalink
CVE-2026-53799
7.2 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
package grsync
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
17 packages
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
Permalink
CVE-2026-53789
7.1 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @leona-ya
- @andir
- @balsoft
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
Permalink
CVE-2026-70456
8.8 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
Permalink
CVE-2026-70460
9.2 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
Permalink
CVE-2026-70458
8.8 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
2 packages
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
16 packages
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- rsync
2 days, 1 hour ago
-
@LeSuisse
restored
package rsync
2 days, 1 hour ago
-
@LeSuisse
ignored
package python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
Permalink
CVE-2026-53801
8.2 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Symlink Race Condition Directory Traversal
Permalink
CVE-2026-70452
9.1 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
Permalink
CVE-2026-70457
8.3 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
15 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- rsync
- python314Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
restored
package rsync
2 days, 1 hour ago
-
@LeSuisse
ignored
4 packages
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @leona-ya
- @balsoft
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
Permalink
CVE-2026-70462
7.1 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): High (H)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): High (H)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- grsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
- python313Packages.sysrsync
- python314Packages.btrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @pyrox0
- @leona-ya
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
Permalink
CVE-2026-53798
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- rsyncy
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
- rrsync
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @leona-ya
- @balsoft
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
Permalink
CVE-2026-53802
8.4 HIGH
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
ignored
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
2 days, 1 hour ago
maintainer.ignore
-
@LeSuisse
ignored
2 references
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
rsync < 3.5.0 Arbitrary File Read via Symlink Following
crun follows rootfs /dev symlink while creating default devices
Permalink
CVE-2026-47766
5.1 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Local (L)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Local (L)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
ignored
8 packages
- nym
- crunch
- y-cruncher
- speedcrunch
- ocaml-crunch
- ocamlPackages.crunch
- ocamlPackages_latest.crunch
- vscode-extensions.42crunch.vscode-openapi
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
crun follows rootfs /dev symlink while creating default devices
kas: security issues < 5.4
Permalink
CVE-2026-47191
2.1 LOW
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): Present (P)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): Present (P)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
ignored
17 packages
- kakasi
- kasasa
- jackass
- kasmweb
- kassert
- omekasy
- gitlab-kas
- kdePackages.kasts
- lohit-fonts.kashmiri
- python313Packages.pykakasi
- python314Packages.pykakasi
- python313Packages.kasa-crypt
- python314Packages.kasa-crypt
- python313Packages.python-kasa
- python314Packages.python-kasa
- perlPackages.MooseXMarkAsMethods
- perl5Packages.MooseXMarkAsMethods
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
kas checks out SHA-like git branches as valid commits
Permalink
CVE-2026-47192
2.1 LOW
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): High (H)
-
Attack Requirement (AT): Present (P)
-
Privileges Required (PR): Low (L)
-
User Interaction (UI): Passive (P)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): High (H)
-
Modified Attack Requirement (MAT): Present (P)
-
Modified Privileges Required (MPR): Low (L)
-
Modified User Interaction (MUI): Passive (P)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
ignored
17 packages
- kakasi
- kasasa
- jackass
- kasmweb
- kassert
- omekasy
- gitlab-kas
- kdePackages.kasts
- lohit-fonts.kashmiri
- python313Packages.pykakasi
- python314Packages.pykakasi
- python313Packages.kasa-crypt
- python314Packages.kasa-crypt
- python313Packages.python-kasa
- python314Packages.python-kasa
- perlPackages.MooseXMarkAsMethods
- perl5Packages.MooseXMarkAsMethods
2 days, 1 hour ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
kas's late signature validation may allow unnoticed repository manipulations
siyuan: security issues < 3.7.4
Permalink
CVE-2026-73609
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels
Permalink
CVE-2026-73049
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
Permalink
CVE-2026-73048
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID
Permalink
CVE-2026-73630
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess
Permalink
CVE-2026-72810
9.2 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): High (H)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): High (H)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
Permalink
CVE-2026-72812
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): None (N)
-
Vulnerable System Impact Integrity (VI): Low (L)
-
Vulnerable System Impact Availability (VA): Low (L)
-
Subsequent System Impact Confidentiality (SC): None (N)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
-
Modified Vulnerable System Impact Integrity (MVI): Low (L)
-
Modified Vulnerable System Impact Availability (MVA): Low (L)
-
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Missing Authorization via refreshBacklink
Permalink
CVE-2026-72811
9.9 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): High (H)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): High (H)
-
Subsequent System Impact Integrity (SI): High (H)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): High (H)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): High (H)
-
Modified Subsequent System Impact Integrity (MSI): High (H)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
2 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 SQL Injection via backlink search
Permalink
CVE-2026-73608
9.2 CRITICAL
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): High (H)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): High (H)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): High (H)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget
Permalink
CVE-2026-73607
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
Permalink
CVE-2026-73610
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 13 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via Local Storage
Permalink
CVE-2026-73606
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Information Disclosure via getRefIDs
Permalink
CVE-2026-73605
6.9 MEDIUM
-
CVSS version (CVSS): 4.0
-
Attack Vector (AV): Network (N)
-
Attack Complexity (AC): Low (L)
-
Attack Requirement (AT): None (N)
-
Privileges Required (PR): None (N)
-
User Interaction (UI): None (N)
-
Vulnerable System Impact Confidentiality (VC): Low (L)
-
Vulnerable System Impact Integrity (VI): None (N)
-
Vulnerable System Impact Availability (VA): None (N)
-
Subsequent System Impact Confidentiality (SC): Low (L)
-
Subsequent System Impact Integrity (SI): None (N)
-
Subsequent System Impact Availability (SA): None (N)
-
Modified Attack Vector (MAV): Network (N)
-
Modified Attack Complexity (MAC): Low (L)
-
Modified Attack Requirement (MAT): None (N)
-
Modified Privileges Required (MPR): None (N)
-
Modified User Interaction (MUI): None (N)
-
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
-
Modified Vulnerable System Impact Integrity (MVI): None (N)
-
Modified Vulnerable System Impact Availability (MVA): None (N)
-
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
-
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
-
Modified Subsequent System Impact Availability (MSA): Negligible (N)
-
Safety (S): Not Defined (X)
-
Automatable (AU): Not Defined (X)
-
Recovery (R): Not Defined (X)
-
Value Density (V): Not Defined (X)
-
Vulnerability Response Effort (RE): Not Defined (X)
-
Provider Urgency (U): Not Defined (X)
-
Confidentiality Req. (CR): Not Defined (X)
-
Integrity Req. (IR): Not Defined (X)
-
Availability Req. (AR): Not Defined (X)
-
Exploit Maturity (E): Not Defined (X)
updated
2 days, 1 hour ago
by @LeSuisse
Activity log
-
Created suggestion
3 days, 14 hours ago
-
@LeSuisse
accepted
2 days, 1 hour ago
-
@LeSuisse
published on GitHub
2 days, 1 hour ago
SiYuan before v3.7.4 Path Traversal via getUniqueFilename