CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,468
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product rclone:rclone. Show all products

31 CVEs, showing 1 to 31
CVESeverityTitlePublished
CVE-2026-93987Low 3.4rclone serve docker Path Traversal via Volume Name
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-93986Low 3.1rclone before 1.75.1 Path Traversal via Directory Listing Names
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-88046Medium 5.3rclone: source object names can escape the configured root on upload
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88045High 7.5rclone: S3 multipart declared-length memory exhaustion
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88044Critical 9.1rclone: RC per-server auth-proxy bypass
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88018Critical 9.8rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88017High 7.3rclone: FTP cross-session auth-proxy backend confusion
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88016High 7.1rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88015Medium 5.3rclone local: crafted Range request against a translated symlink panics (DoS)
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88014Medium 6.3rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88013Low 3.7rclone: http backend forwards custom/auth headers to a different host on redirect
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-79783Low 3.6rclone before 1.74.4 Privilege Escalation via setuid Metadata
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79782Low 3.1rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79781Medium 6.5rclone serve s3 Path Traversal via dot-dot object keys
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79780Medium 5.3rclone before v1.75.0 Credential Exposure via S3 Redirect
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79779Medium 5.3rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79778Medium 5.3rclone before v1.75.0 Denial of Service via TUS nil-response panic
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79777Low 2.7rclone before v1.75.0 Information Disclosure via RC API
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79776Medium 5.3rclone before 1.75.0 Authentication Bypass via pprof
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-79775Medium 6.5rclone Archive Backend SquashFS Parser Denial of Service
Assigned by VulnCheck
Aug 25, 2026
CVE-2026-71313Medium 6.9rclone: Local Encoding Path Traversal
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-71312High 8.0rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-71311Medium 6.4rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-71310Medium 5.9rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-71309High 8.6rclone: Incomplete path validation allows backend root escape in serve restic
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-59733High 8.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Jul 14, 2026
CVE-2026-59732Medium 5.0Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Jul 14, 2026
CVE-2026-54572High 8.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Jul 14, 2026
CVE-2026-49980Critical 9.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Jun 24, 2026
CVE-2026-41179Critical 9.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Apr 23, 2026
CVE-2026-41176Critical 9.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Apr 23, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.