Medium, CVSS 5.0
rclone archive extract allows S3 destination prefix escape via crafted archive paths
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59732 · GHSA-4vr5-p2gc-h23p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3001–3025 of 30,921 matching · newest first
- Critical, CVSS 9.3
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79782 · GHSA-gx4c-2hqx-cw2r · amended
- High, CVSS 8.8
rclone
serve restic --private-reposauthorization bypass:..in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-59733 · GHSA-fqj9-69pf-6pjg · amended
- High, CVSS 8.0
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-71312 · GHSA-2m8m-jhrm-w6j2 · amended
- Medium, CVSS 6.0
rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79779 · GHSA-h4mf-4v27-hggj · amended
- Medium, CVSS 6.4
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · < 1.75.0 · CVE-2026-71311 · GHSA-8c48-q9wj-3w37 · amended
- Medium, CVSS 6.0
rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79780 · GHSA-8mxv-9xhp-86h4 · amended
- Medium, CVSS 6.9
rclone: Path traversal in serve s3 allows reading and overwriting root-level files
Go github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79781 · GHSA-8v25-v8p6-qf7v · amended
- Medium, CVSS 6.0
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-79778 · GHSA-3x6r-wxxg-53vv · amended
- Medium, CVSS 5.9
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.0 · CVE-2026-71310 · GHSA-xhf4-832v-7xcr · amended
- High, CVSS 7.5
rclone: Unvalidated symlink target in local
--links— arbitrary file write from an untrusted remoteGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-54572 · GHSA-cf44-9pgv-m4xc · amended
- High, CVSS 8.6
rclone: Incomplete path validation allows backend root escape in serve restic
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · >= 1.40.0, < 1.75.0 · CVE-2026-71309 · GHSA-45pq-889g-fcgh · amended
- Low, CVSS 2.0
rclone local
--metadataapplies attacker-controlled mode/uid - setuid binary planted from an untrusted remoteGo github.com/rclone/rclone · Upgrade to 1.74.4 or later · <= 1.74.3 · CVE-2026-79783 · GHSA-945v-v9p3-v5xw · amended
- Medium, CVSS 5.1
rclone: Verbose Stack Trace Disclosure in RC API Error Responses
Go github.com/rclone/rclone · Upgrade to 1.75.0 or later · <= 1.74.4 · CVE-2026-79777 · GHSA-gwfq-86j8-7qhv · amended
- Medium, CVSS 5.4
Electron: Sandboxed iframes can launch external protocol handlers
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.0 or 39.8.8 by release line · < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70612 · GHSA-p2rr-rvmm-c5fp
- Medium, CVSS 6.9
Electron: DevTools embedder handler executes arbitrary files via shell open
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70611 · GHSA-f2r8-jv7c-xqmp
- Medium, CVSS 5.4
Electron: contextBridge object copy honors prototype setters
npm electron · Upgrade to 42.0.0-beta.4 (pre-release), 41.2.2, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.4 · CVE-2026-70610 · GHSA-ff2p-hmqr-hxm4
- Medium, CVSS 5.7
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
npm electron · Upgrade to 42.0.0-beta.1 (pre-release), 41.2.0, 40.9.0 or 39.8.7 by release line · < 39.8.7; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.0; >= 42.0.0-alpha.1, < 42.0.0-beta.1 · CVE-2026-70609 · GHSA-4f78-qhmw-8j8m
- High, CVSS 7.2
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
npm electron · Upgrade to 42.0.1, 41.10.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.1; >= 40.0.0-alpha.1, < 41.10.3; < 39.8.10 · CVE-2026-70608 · GHSA-9f4c-93c8-jc8g
- Medium, CVSS 5.3
Electron: window.open features string controls some window options considered privileged
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.0 or 39.8.8 by release line · < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70607 · GHSA-v93f-fgjr-hjrj
- Medium, CVSS 5.9
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
npm electron · Upgrade to 43.0.0, 42.5.1, 41.9.1 or 40.10.6 by release line · >= 43.0.0-alpha.1, < 43.0.0; >= 42.0.0-alpha.1, < 42.5.1; >= 41.0.0-alpha.1, < 41.9.1; >= 40.0.0-alpha.1, < 40.10.6 · CVE-2026-70606 · GHSA-r4w5-6pfg-jxp5
- High, CVSS 7.4
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
npm electron · Upgrade to 42.0.0, 41.4.0, 40.9.3 or 39.8.10 by release line · >= 42.0.0-alpha.1, < 42.0.0; >= 41.0.0-alpha.1, < 41.4.0; >= 40.0.0-alpha.1, < 40.9.3; < 39.8.10 · CVE-2026-70604 · GHSA-v3j7-r9gq-3gjw
- Medium, CVSS 6.6
Electron: Extension tab APIs operate across session boundaries
npm electron · Upgrade to 42.0.0-beta.3 (pre-release), 41.2.1, 40.9.0 or 39.8.8 by release line · < 39.8.8; >= 40.0.0-alpha.1, < 40.9.0; >= 41.0.0-alpha.1, < 41.2.1; >= 42.0.0-alpha.1, < 42.0.0-beta.3 · CVE-2026-70602 · GHSA-m55f-7gqj-fr98
- Medium, CVSS 6.0
Electron: shell.openPath path validation bypass via embedded null byte
npm electron · Upgrade to 42.0.0-beta.1 (pre-release), 41.1.1, 40.9.0 or 39.8.6 by release line · >= 42.0.0-alpha.1, < 42.0.0-beta.1; >= 41.0.0-alpha.1, < 41.1.1; >= 40.0.0-alpha.1, < 40.9.0; < 39.8.6 · CVE-2026-70603 · GHSA-5c9j-mhmv-5xgx
- High, CVSS 7.5
Electron: Context isolation bypass via Function.prototype.bind hijack
npm electron · Upgrade to 42.0.0-beta.5 (pre-release), 41.2.2, 40.9.2 or 39.8.9 by release line · < 39.8.9; >= 40.0.0-alpha.1, < 40.9.2; >= 41.0.0-alpha.1, < 41.2.2; >= 42.0.0-alpha.1, < 42.0.0-beta.5 · CVE-2026-70601 · GHSA-h7rp-cf8h-j98x
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.