{"kind": "feed", "path": "vulns/feed", "name": "", "items": [{"id": "CVE-2026-116053", "noindex": false, "published": "2026-10-25T13:30:09.456Z", "modified": "2026-10-25T13:30:09.456Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116053", "title": "dbcli mycli Whitelist source.py source_special_command_is_safe os command injection", "description": "A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/vuln/426137", "https://vuldb.com/vuln/426137/cti", "https://vuldb.com/cve/CVE-2026-116053"], "fixes": [], "products": [{"name": "mycli", "path": "vulns/mycli", "ecosystem": ""}]}, {"id": "CVE-2026-116186", "noindex": false, "published": "2026-10-25T13:22:10.154Z", "modified": "2026-10-25T13:22:10.154Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116186", "title": "OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId", "description": "OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.", "references": ["https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4", "https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid", "https://nvd.nist.gov/vuln/detail/CVE-2026-116186"], "fixes": ["1.31.0"], "products": [{"name": "core", "path": "vulns/core", "ecosystem": ""}]}, {"id": "CVE-2026-116185", "noindex": false, "published": "2026-10-25T13:22:09.474Z", "modified": "2026-10-25T13:22:09.474Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116185", "title": "OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos", "description": "OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.", "references": ["https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3", "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos", "https://nvd.nist.gov/vuln/detail/CVE-2026-116185"], "fixes": ["1.31.0"], "products": [{"name": "core", "path": "vulns/core", "ecosystem": ""}]}, {"id": "CVE-2026-116184", "noindex": false, "published": "2026-10-25T13:22:08.792Z", "modified": "2026-10-25T13:22:08.792Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116184", "title": "OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket", "description": "OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.", "references": ["https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm", "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket", "https://nvd.nist.gov/vuln/detail/CVE-2026-116184"], "fixes": ["1.31.0"], "products": [{"name": "core", "path": "vulns/core", "ecosystem": ""}]}, {"id": "CVE-2026-116211", "noindex": false, "published": "2026-10-25T13:20:38.819Z", "modified": "2026-10-25T13:20:38.819Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116211", "title": "YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create", "description": "YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx", "https://www.vulncheck.com/advisories/yeswiki-4.5.0-before-4.7.0-sql-injection-via-date-maj-fiche-in-bazar-entry-create", "https://nvd.nist.gov/vuln/detail/CVE-2026-116211"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116208", "noindex": false, "published": "2026-10-25T13:20:38.152Z", "modified": "2026-10-25T13:20:38.152Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116208", "title": "YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts", "description": "YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j", "https://www.vulncheck.com/advisories/yeswiki-4.6.2-before-4.7.0-missing-authorization-in-activitypub-syncactorposts", "https://nvd.nist.gov/vuln/detail/CVE-2026-116208"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116207", "noindex": false, "published": "2026-10-25T13:20:37.473Z", "modified": "2026-10-25T13:20:37.473Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116207", "title": "YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API", "description": "YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh", "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877", "https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api"], "fixes": ["4.7.0", "5.0.0-alpha4"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}, {"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116206", "noindex": false, "published": "2026-10-25T13:20:36.803Z", "modified": "2026-10-25T13:20:36.803Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116206", "title": "YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax", "description": "YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6", "https://www.vulncheck.com/advisories/yeswiki-4.2.0-before-4.7.0-stored-xss-via-comment-raw-html-syntax", "https://nvd.nist.gov/vuln/detail/CVE-2026-116206"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116205", "noindex": false, "published": "2026-10-25T13:20:35.879Z", "modified": "2026-10-25T13:20:35.879Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116205", "title": "YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax", "description": "YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc", "https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax", "https://nvd.nist.gov/vuln/detail/CVE-2026-116205"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116204", "noindex": false, "published": "2026-10-25T13:20:35.206Z", "modified": "2026-10-25T13:20:35.206Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116204", "title": "YesWiki before 4.7.0 CSRF via despam Admin Action", "description": "YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72", "https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action", "https://nvd.nist.gov/vuln/detail/CVE-2026-116204"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116203", "noindex": false, "published": "2026-10-25T13:20:34.532Z", "modified": "2026-10-25T13:20:34.532Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116203", "title": "YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters", "description": "YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allow_raw_html gate, executing JavaScript for every page viewer.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f53x-3gqx-xq76", "https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-filtertags-action-parameters", "https://nvd.nist.gov/vuln/detail/CVE-2026-116203"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116202", "noindex": false, "published": "2026-10-25T13:20:33.851Z", "modified": "2026-10-25T13:20:33.851Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116202", "title": "YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload", "description": "YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.", "references": ["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-c5q6-7233-3v6g", "https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-imagefield-svg-upload", "https://nvd.nist.gov/vuln/detail/CVE-2026-116202"], "fixes": ["4.7.0"], "products": [{"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}]}, {"id": "CVE-2026-116201", "noindex": false, "published": "2026-10-25T13:20:33.187Z", "modified": "2026-10-25T13:20:33.187Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116201", "title": "Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition", "description": "Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.", "references": ["https://github.com/grokability/snipe-it/security/advisories/GHSA-w49g-f2jc-qxhg", "https://www.vulncheck.com/advisories/snipe-it-before-8.5.0-saml-assertion-replay-via-race-condition", "https://nvd.nist.gov/vuln/detail/CVE-2026-116201"], "fixes": ["8.5.0"], "products": [{"name": "snipe-it", "path": "vulns/snipe-it", "ecosystem": ""}]}, {"id": "CVE-2026-116200", "noindex": false, "published": "2026-10-25T13:20:32.506Z", "modified": "2026-10-25T13:20:32.506Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116200", "title": "Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()", "description": "Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.", "references": ["https://github.com/grokability/snipe-it/security/advisories/GHSA-wx48-r3qh-jvh5", "https://www.vulncheck.com/advisories/snipe-it-before-8.6.3-ldap-starttls-downgrade-via-connecttoldap", "https://nvd.nist.gov/vuln/detail/CVE-2026-116200"], "fixes": ["8.6.3"], "products": [{"name": "snipe-it", "path": "vulns/snipe-it", "ecosystem": ""}]}, {"id": "CVE-2026-116199", "noindex": false, "published": "2026-10-25T13:20:31.815Z", "modified": "2026-10-25T13:20:31.815Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116199", "title": "Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback", "description": "Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.", "references": ["https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp", "https://www.vulncheck.com/advisories/snipe-it-before-8.6.3-authentication-bypass-via-google-sso-callback", "https://nvd.nist.gov/vuln/detail/CVE-2026-116199"], "fixes": ["8.6.3"], "products": [{"name": "snipe-it", "path": "vulns/snipe-it", "ecosystem": ""}]}, {"id": "CVE-2026-116198", "noindex": false, "published": "2026-10-25T13:20:31.140Z", "modified": "2026-10-25T13:20:31.140Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116198", "title": "Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store", "description": "Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.", "references": ["https://github.com/grokability/snipe-it/security/advisories/GHSA-jh4g-98fm-jcqc", "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-encryption-via-api-assetscontroller-store", "https://nvd.nist.gov/vuln/detail/CVE-2026-116198"], "fixes": ["8.7.0"], "products": [{"name": "snipe-it", "path": "vulns/snipe-it", "ecosystem": ""}]}, {"id": "CVE-2026-116197", "noindex": false, "published": "2026-10-25T13:20:30.463Z", "modified": "2026-10-25T13:20:30.463Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116197", "title": "Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection", "description": "Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.", "references": ["https://github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr", "https://www.vulncheck.com/advisories/contrast-1.21.0-before-1.25.0-credential-leak-via-imagepuller-wildcard-registry-selection", "https://nvd.nist.gov/vuln/detail/CVE-2026-116197"], "fixes": ["1.25.0"], "products": [{"name": "contrast", "path": "vulns/contrast", "ecosystem": ""}]}, {"id": "CVE-2026-116196", "noindex": false, "published": "2026-10-25T13:20:29.804Z", "modified": "2026-10-25T13:20:29.804Z", "cvss": 6.0, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116196", "title": "Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url", "description": "Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72", "https://www.vulncheck.com/advisories/rclone-before-1.75.2-b2-credential-leak-on-redirect-via-b2-download-url", "https://nvd.nist.gov/vuln/detail/CVE-2026-116196"], "fixes": ["1.75.2"], "products": [{"name": "rclone", "path": "vulns/rclone", "ecosystem": ""}]}, {"id": "CVE-2026-116195", "noindex": false, "published": "2026-10-25T13:20:29.131Z", "modified": "2026-10-25T13:20:29.131Z", "cvss": 7.0, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116195", "title": "Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim", "description": "Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827", "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim", "https://nvd.nist.gov/vuln/detail/CVE-2026-116195"], "fixes": ["1.75.2"], "products": [{"name": "rclone", "path": "vulns/rclone", "ecosystem": ""}]}, {"id": "CVE-2026-116194", "noindex": false, "published": "2026-10-25T13:20:28.466Z", "modified": "2026-10-25T13:20:28.466Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [], "path": "vulns/cve-2026-116194", "title": "Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback", "description": "Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46", "https://www.vulncheck.com/advisories/rclone-1.52.0-before-1.75.2-csrf-via-pcloud-oauth-callback", "https://nvd.nist.gov/vuln/detail/CVE-2026-116194"], "fixes": ["1.75.2"], "products": [{"name": "rclone", "path": "vulns/rclone", "ecosystem": ""}]}], "total": 484464, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mycli", "path": "vulns/mycli", "ecosystem": ""}, {"name": "core", "path": "vulns/core", "ecosystem": ""}, {"name": "yeswiki", "path": "vulns/yeswiki", "ecosystem": ""}, {"name": "snipe-it", "path": "vulns/snipe-it", "ecosystem": ""}, {"name": "contrast", "path": "vulns/contrast", "ecosystem": ""}, {"name": "rclone", "path": "vulns/rclone", "ecosystem": ""}, {"name": "node.js", "path": "vulns/node.js", "ecosystem": ""}, {"name": "php", "path": "vulns/php", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 19020, "kev": 20}, "lastmod": "2026-10-25T13:30:09.456Z", "early_advisories": [{"fixes": [], "id": "EA-auto-4bff2f84a4193db76ba2e9516480ce082aff4b257b52d171", "cves": ["CVE-2026-111497"], "texts": {"de": {"title": "Node.js: Remote-Codeausführung", "description": "Laut OpenNet wurde in Node.js eine Sicherheitslücke gefunden: Remote-Codeausführung (CVE-2026-111497). Die betroffenen Versionen sind nicht genau angegeben. Im Bericht wird keine Version mit Fehlerbehebung genannt.", "action": "Prüfen Sie, ob ein Update für Node.js mit der Fehlerbehebung verfügbar ist, und installieren Sie es."}, "en": {"title": "Node.js: remote code execution", "description": "According to OpenNet, Node.js has a remote code execution vulnerability (CVE-2026-111497). The exact affected versions are unspecified. The report does not name a fixed version.", "action": "Check whether a Node.js update with the fix is available and install it."}, "es": {"title": "Node.js: ejecución remota de código", "description": "Según OpenNet, Node.js tiene una vulnerabilidad de ejecución remota de código (CVE-2026-111497). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.", "action": "Comprueba si hay una actualización de Node.js con la corrección e instálala."}, "fr": {"title": "Node.js : exécution de code à distance", "description": "Selon OpenNet, Node.js présente une vulnérabilité d’exécution de code à distance (CVE-2026-111497). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.", "action": "Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la."}}, "affected": {"all_supported": false, "branches": [], "ranges": []}, "updated_at": "2026-10-25T06:34:44.314509Z", "candidate_id": "a37e75e35b2b428b3d695bbb722cf7a5a6cb270f98b9a69a0fb5008f4155b333", "sources": [{"name": "opennet", "url": "https://www.opennet.ru/opennews/art.shtml?num=66537"}, {"name": "oss-security", "url": "https://seclists.org/oss-sec/2026/q4/373"}], "fix_status": "unfixed", "created_at": "2026-10-24T19:15:10.159140Z", "fixed_version": "", "product": "node.js", "state": "published"}, {"fixes": [], "id": "EA-auto-43744e2e5c9a208ed806e57a9b42af7ed13757e08dcfc2e8", "cves": ["CVE-2026-115560"], "texts": {"de": {"title": "PHP: Remote-Codeausführung", "description": "Laut OpenNet wurde in PHP eine Sicherheitslücke gefunden: Remote-Codeausführung (CVE-2026-115560). Die betroffenen Versionen sind nicht genau angegeben. Im Bericht wird keine Version mit Fehlerbehebung genannt.", "action": "Prüfen Sie, ob ein Update für PHP mit der Fehlerbehebung verfügbar ist, und installieren Sie es."}, "en": {"title": "PHP: remote code execution", "description": "According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.", "action": "Check whether a PHP update with the fix is available and install it."}, "es": {"title": "PHP: ejecución remota de código", "description": "Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.", "action": "Comprueba si hay una actualización de PHP con la corrección e instálala."}, "fr": {"title": "PHP : exécution de code à distance", "description": "Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.", "action": "Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la."}}, "affected": {"all_supported": false, "branches": [], "ranges": []}, "updated_at": "2026-10-24T17:08:02.545120Z", "candidate_id": "63ebe2e680c5dd94d54a881dabfd180796897bf3bf44a3b15d1ec396cb8a181a", "sources": [{"name": "opennet", "url": "https://www.opennet.ru/opennews/art.shtml?num=66534"}, {"name": "the-hacker-news", "url": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"}], "fix_status": "unfixed", "created_at": "2026-10-24T17:05:52.430295Z", "fixed_version": "", "product": "php", "state": "published"}], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}