Permalink CVE-2026-53798

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

• GitHub Security Advisory (GHSA-hx7p-3gvv-pqgv) vendor-advisory
• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-convert… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-70454

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

• GitHub Security Advisory (GHSA-3c3x-ww2w-5r5p) vendor-advisory
• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-vi… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-72839

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

filebrowser through 2.63.16 Privilege Escalation via Signup

• GitHub Security Advisory (GHSA-6759-996p-gpj6) vendor-advisory
• VulnCheck Advisory: filebrowser through 2.63.16 Privilege Escalation via Signup third-party-advisory

---

filebrowser

• =<2.63.16

Permalink CVE-2026-73565

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg x_refsource_CONFIRM
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1 x_refsource_MISC
• https://github.com/honojs/node-server/releases/tag/v2.0.10 x_refsource_MISC

---

node-server

• ==>= 2.0.0, < 2.0.10

Permalink CVE-2026-53784

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

rsync < 3.5.0 Path Traversal via Symlink Module Root

• GitHub Security Advisory (GHSA-ffg2-fr5g-3rxw) vendor-advisory
• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-ro… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2026-21832

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

HCL AION is affected by multiple security vulnerabilities.

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084

---

AION

• ==v2.5.0

Permalink CVE-2026-70457

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

• GitHub Security Advisory (GHSA-pg7g-xqmr-xpfh) vendor-advisory
• Release Notes release-notes
• https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-a… third-party-advisory

---

rsync

• ==3.5.0
• =<3.4.4

Permalink CVE-2022-4993

created 18 hours ago Activity log

• Created suggestion 18 hours ago

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

• https://security.metacpan.org/patches/H/HTML-FormHandler/0.40068/CVE-2022-4993-… patch
• https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/Fo…
• https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/Fo…
• https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/Fo…
• https://www.cve.org/CVERecord?id=CVE-2012-6329 related

---

HTML-FormHandler

• =<0.40068

Permalink CVE-2026-73573

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability …

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy

---

Collaboration

• <10.1.17

Permalink CVE-2026-73564

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

created 18 hours ago Activity log

• Created suggestion 18 hours ago

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

• https://github.com/fatedier/frp/security/advisories/GHSA-26gq-p25f-99cp x_refsource_CONFIRMexploit
• https://github.com/fatedier/frp/pull/5428 x_refsource_MISC
• https://github.com/fatedier/frp/commit/7dc7be930e2452ae93fd32f2a77f8c6fcd0b652b x_refsource_MISC
• https://github.com/fatedier/frp/releases/tag/v0.70.1 x_refsource_MISC

---

frp

• ==>= 0.53.0, < 0.70.1