Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Rclone CVE-2026-116196
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redi
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit -
Rclone CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Rclone CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Rclone CVE-2026-116193
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by send
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Rclone CVE-2026-116192
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backen
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Rclone CVE-2026-116191
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit -
Rclone CVE-2026-116190
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential he
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Rclone CVE-2026-116189
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clear
5 CVEs and 5 credit lines. None claimed yet.
0 of 5 credit lines claimed Claim credit -
Rclone CVE-2026-116188
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buff
5 CVEs and 5 credit lines. None claimed yet.
0 of 5 credit lines claimed Claim credit -
Rclone CVE-2026-116187
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit