Archive
13 August 2026
Vulnerabilities first published on this day (UTC), newest first.
275 results · Clear filters · Feed
-
High 7.1
Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belongin…
-
High 8.2
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename. load_lexicon builds the catalog path by appendi…
-
High 8.7
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with a…
-
High 8.1
PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field …
-
High 8.8
PostGIS address_standardizer Out-of-Bounds Write via standardize_address()
The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger me…
-
High 7.2
CMS Admin SQL Injection via db_data.php table_name Parameter
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Atta…
-
High 8.9
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp…
KEV Aug 21, 2026 -
High 7.3
SourceCodester Simple Student Information System view_department.php sql injection
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql inject…
-
High 7.0
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and L…
-
High 7.8
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Mana…
-
High 7.3
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could al…
-
High 7.8
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Ma…
-
High 7.1
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allo…
-
High 7.1
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial …
-
High 7.0
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authentic…
-
High 7.4
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV…
-
High 7.4
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based de…
-
High 7.5
rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case be…
-
High 8.0
rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. A…
-
High 7.5
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option…
-
High 8.2
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exac…
-
High 8.2
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers ca…
-
High 8.1
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place…
-
High 8.2
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the …
-
High 8.1CVE-2026-70463 Public exploit
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name co…
-
High 7.5
rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. A…
-
High 8.1
rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when th…
-
High 7.4
rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary mar…
-
High 8.1
rsync < 3.5.0 Command Injection via Multiple Code Paths
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks…
-
High 7.1
rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows sy…
-
High 7.1
rsync < 3.5.0 Path Traversal via Symlink Module Root
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the modu…
-
High 8.1
rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component …
-
High 7.8
rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can …
-
High 7.1
rsync < 3.5.0 Arbitrary File Read via Symlink Following
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filte…
-
High 7.6
OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewN…
-
High 7.1
WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue a…
-
High 7.5
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote att…
-
High 7.6
Bypassing passkey entry in legacy pairing
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
-
High 7.1
BT122 plaintext pause encryption request causes DOS
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.
-
High 7.8
Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so…