RC
Vendor
rclone
43
CVEs
0
On KEV
10
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116196 New | RC rclone rclone | 5.3 | Oct 25 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url |
| CVE-2026-116195 New | RC rclone rclone | 6.1 | Oct 25 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim |
| CVE-2026-116194 New | RC rclone rclone | 6.8 | Oct 25 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback |
| CVE-2026-116193 New | RC rclone rclone | 5.3 | Oct 25 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests |
| CVE-2026-116192 New | RC rclone rclone | 5.9 | Oct 25 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots |
| CVE-2026-116191 New | RC rclone rclone | 7.5 | Oct 25 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL |
| CVE-2026-116190 New | RC rclone rclone | 3.7 | Oct 25 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect |
| CVE-2026-116189 New | RC rclone rclone | 7.5 | Oct 25 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS |
| CVE-2026-116188 New | RC rclone rclone | 5.3 | Oct 25 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow |
| CVE-2026-116187 New | RC rclone rclone | 5.0 | Oct 25 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads |
| CVE-2026-93987 | RC rclone rclone | 3.4 | Sep 19 | rclone serve docker Path Traversal via Volume Name |
| CVE-2026-93986 | RC rclone rclone | 3.1 | Sep 19 | rclone before 1.75.1 Path Traversal via Directory Listing Names |
| CVE-2026-88046 | RC rclone rclone | 5.3 | Sep 10 | rclone: source object names can escape the configured root on upload |
| CVE-2026-88045 | RC rclone rclone | 7.5 | Sep 10 | rclone: S3 multipart declared-length memory exhaustion |
| CVE-2026-88044 | RC rclone rclone | 9.1 | Sep 10 | rclone: RC per-server auth-proxy bypass |
| CVE-2026-88018 | RC rclone rclone | 9.8 | Sep 10 | rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass |
| CVE-2026-88017 | RC rclone rclone | 7.3 | Sep 10 | rclone: FTP cross-session auth-proxy backend confusion |
| CVE-2026-88016 | RC rclone rclone | 7.1 | Sep 10 | rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination |
| CVE-2026-88015 | RC rclone rclone | 5.3 | Sep 10 | rclone local: crafted Range request against a translated symlink panics (DoS) |
| CVE-2026-88014 | RC rclone rclone | 6.3 | Sep 10 | rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace |
| CVE-2026-88013 | RC rclone rclone | 5.3 | Sep 10 | rclone: http backend forwards custom/auth headers to a different host on redirect |
| CVE-2026-79783 | RC rclone rclone | 3.6 | Aug 25 | rclone before 1.74.4 Privilege Escalation via setuid Metadata |
| CVE-2026-79782 | RC rclone rclone | 3.1 | Aug 25 | rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect |
| CVE-2026-79781 | RC rclone rclone | 6.5 | Aug 25 | rclone serve s3 Path Traversal via dot-dot object keys |
| CVE-2026-79780 | RC rclone rclone | 5.3 | Aug 25 | rclone before v1.75.0 Credential Exposure via S3 Redirect |
| CVE-2026-79779 | RC rclone rclone | 5.3 | Aug 25 | rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect |
| CVE-2026-79778 | RC rclone rclone | 5.3 | Aug 25 | rclone before v1.75.0 Denial of Service via TUS nil-response panic |
| CVE-2026-79777 | RC rclone rclone | 2.7 | Aug 25 | rclone before v1.75.0 Information Disclosure via RC API |
| CVE-2026-79776 | RC rclone rclone | 5.3 | Aug 25 | rclone before 1.75.0 Authentication Bypass via pprof |
| CVE-2026-79775 | RC rclone rclone | 6.5 | Aug 25 | rclone Archive Backend SquashFS Parser Denial of Service |
| CVE-2026-71313 | RC rclone rclone | 6.9 | Aug 5 | rclone: Local Encoding Path Traversal |
| CVE-2026-71312 | RC rclone rclone | 8.0 | Aug 5 | rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution |
| CVE-2026-71311 | RC rclone rclone | 6.4 | Aug 5 | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines |
| CVE-2026-71310 | RC rclone rclone | 5.9 | Aug 5 | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory |
| CVE-2026-71309 | RC rclone rclone | 8.6 | Aug 5 | rclone: Incomplete path validation allows backend root escape in serve restic |
| CVE-2026-59733 | RC rclone rclone | 8.8 | Jul 14 | rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories |
| CVE-2026-54572 | RC rclone rclone | 8.8 | Jul 14 | rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote |
| CVE-2026-59732 | RC rclone rclone | 5.0 | Jul 14 | rclone archive extract allows S3 destination prefix escape via crafted archive paths |
| CVE-2026-49980 | RC rclone rclone | 9.8 | Jun 24 | Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix |
| CVE-2026-41179 | RC rclone rclone | 9.8 | Apr 23 | RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution |
| CVE-2026-41176 | RC rclone rclone | 9.8 | Apr 22 | Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution |
| CVE-2020-28924 | RC Rclone Rclone | 7.5 | Nov 19 | An issue was discovered in Rclone before 1.53.3 |
| CVE-2018-12907 | RC Rclone Rclone | 7.5 | Jun 27 | In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google,… |