Every CVE Search/ Get API key

CVE-2026-41179

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

9.2 CriticalPublic exploitFix available

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

8.58%Up 8.5 points since Apr 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
CVE-2026-41179
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-306, CWE-94
Updated
2026-11-02
EUVDEUVD-2026-25144 9.2

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
EUVD-2026-25144
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jfwf-28xr-xw6q 9.2

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Summary

The RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.

Preconditions

Preconditions for this vulnerability are:

  • The rclone remote control API must be enabled, either by the --rc flag or by running the rclone rcd server
  • The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the --rc-addr flag is in use
  • The rc must have been deployed without global RC HTTP authentication - so not using --rc-user/--rc-pass/--rc-htpasswd/etc

Details

The root cause consists of the following pieces:

  1. operations/fsinfo is not protected with AuthRequired: true
  2. operations/fsinfo calls rc.GetFs(...) on attacker-controlled input
  3. rc.GetFs(...) supports inline backend creation through object-valued fs
  4. WebDAV backend initialization executes bearer_token_command

Relevant code paths:

  • fs/operations/rc.go

    • operations/fsinfo is registered without AuthRequired: true
    • rcFsInfo() calls rc.GetFs(ctx, in)

  • fs/rc/cache.go

    • GetFs() / GetFsNamed() can parse an object-valued fs
    • getConfigMap() converts attacker-controlled JSON into a backend config string

  • backend/webdav/webdav.go

    • bearer_token_command is a supported backend option
    • NewFs(...) calls fetchAndSetBearerToken() when bearer_token_command is set
    • fetchBearerToken() invokes exec.Command(...)

This creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.

This was alidated on:

  • current master as of 2026-04-14: bf55d5e6d37fd86164a87782191f9e1ffcaafa82
  • latest public release tested locally: v1.73.4

This was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).

PoC

Minimal single-request form PoC

Start a vulnerable RC server:

rclone rcd --rc-addr 127.0.0.1:5572

No --rc-user, no --rc-pass, no --rc-htpasswd.

Then send a single request:

curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
  --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"

Expected result:

  • HTTP 200 JSON response from operations/fsinfo
  • /tmp/rclone_fsinfo_rce_poc_marker is created on the host

Impact

This is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.

In practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.

Testing performed

This was successfully reproduced:

  • on a local test environment
  • on a public amd64 Ubuntu host controlled by the tester

On the public host it was confirmed:

  • the unauthenticated operations/fsinfo exploit worked
  • command execution occurred on the host
  • the issue was reproducible through direct host execution
Record
GHSA-jfwf-28xr-xw6q
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-306
Updated
2026-11-02
NVD 9.2

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
CVE-2026-41179
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-306, CWE-94
Updated
2026-11-02
OSVALPINE-CVE-2026-41179 9.8

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
ALPINE-CVE-2026-41179
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.2

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
CVE-2026-41179
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-306, CWE-78
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-41179 9.8

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
DEBIAN-CVE-2026-41179
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-jfwf-28xr-xw6q 9.2

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Summary

The RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.

Preconditions

Preconditions for this vulnerability are:

  • The rclone remote control API must be enabled, either by the --rc flag or by running the rclone rcd server
  • The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the --rc-addr flag is in use
  • The rc must have been deployed without global RC HTTP authentication - so not using --rc-user/--rc-pass/--rc-htpasswd/etc

Details

The root cause consists of the following pieces:

  1. operations/fsinfo is not protected with AuthRequired: true
  2. operations/fsinfo calls rc.GetFs(...) on attacker-controlled input
  3. rc.GetFs(...) supports inline backend creation through object-valued fs
  4. WebDAV backend initialization executes bearer_token_command

Relevant code paths:

  • fs/operations/rc.go

    • operations/fsinfo is registered without AuthRequired: true
    • rcFsInfo() calls rc.GetFs(ctx, in)

  • fs/rc/cache.go

    • GetFs() / GetFsNamed() can parse an object-valued fs
    • getConfigMap() converts attacker-controlled JSON into a backend config string

  • backend/webdav/webdav.go

    • bearer_token_command is a supported backend option
    • NewFs(...) calls fetchAndSetBearerToken() when bearer_token_command is set
    • fetchBearerToken() invokes exec.Command(...)

This creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.

This was alidated on:

  • current master as of 2026-04-14: bf55d5e6d37fd86164a87782191f9e1ffcaafa82
  • latest public release tested locally: v1.73.4

This was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).

PoC

Minimal single-request form PoC

Start a vulnerable RC server:

rclone rcd --rc-addr 127.0.0.1:5572

No --rc-user, no --rc-pass, no --rc-htpasswd.

Then send a single request:

curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
  --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"

Expected result:

  • HTTP 200 JSON response from operations/fsinfo
  • /tmp/rclone_fsinfo_rce_poc_marker is created on the host

Impact

This is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.

In practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.

Testing performed

This was successfully reproduced:

  • on a local test environment
  • on a public amd64 Ubuntu host controlled by the tester

On the public host it was confirmed:

  • the unauthenticated operations/fsinfo exploit worked
  • command execution occurred on the host
  • the issue was reproducible through direct host execution
Record
GHSA-jfwf-28xr-xw6q
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306, CWE-78
Updated
2026-11-02
OSVJLSEC-2026-281 9.2

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Summary

The RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.

Preconditions

Preconditions for this vulnerability are:

  • The rclone remote control API must be enabled, either by the --rc flag or by running the rclone rcd server
  • The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the --rc-addr flag is in use
  • The rc must have been deployed without global RC HTTP authentication - so not using --rc-user/--rc-pass/--rc-htpasswd/etc

Details

The root cause consists of the following pieces:

  1. operations/fsinfo is not protected with AuthRequired: true
  2. operations/fsinfo calls rc.GetFs(...) on attacker-controlled input
  3. rc.GetFs(...) supports inline backend creation through object-valued fs
  4. WebDAV backend initialization executes bearer_token_command

Relevant code paths:

  • fs/operations/rc.go

    • operations/fsinfo is registered without AuthRequired: true
    • rcFsInfo() calls rc.GetFs(ctx, in)

  • fs/rc/cache.go

    • GetFs() / GetFsNamed() can parse an object-valued fs
    • getConfigMap() converts attacker-controlled JSON into a backend config string

  • backend/webdav/webdav.go

    • bearer_token_command is a supported backend option
    • NewFs(...) calls fetchAndSetBearerToken() when bearer_token_command is set
    • fetchBearerToken() invokes exec.Command(...)

This creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.

This was alidated on:

  • current master as of 2026-04-14: bf55d5e6d37fd86164a87782191f9e1ffcaafa82
  • latest public release tested locally: v1.73.4

This was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).

PoC

Minimal single-request form PoC

Start a vulnerable RC server:

rclone rcd --rc-addr 127.0.0.1:5572

No --rc-user, no --rc-pass, no --rc-htpasswd.

Then send a single request:

curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
  --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"

Expected result:

  • HTTP 200 JSON response from operations/fsinfo
  • /tmp/rclone_fsinfo_rce_poc_marker is created on the host

Impact

This is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.

In practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.

Testing performed

This was successfully reproduced:

  • on a local test environment
  • on a public amd64 Ubuntu host controlled by the tester

On the public host it was confirmed:

  • the unauthenticated operations/fsinfo exploit worked
  • command execution occurred on the host
  • the issue was reproducible through direct host execution
Record
JLSEC-2026-281
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-41179 9.8

CVE-2026-41179 in rootio-github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-41179 in the rootio-github.com/rclone/rclone package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-41179
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41179 9.2

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
UBUNTU-CVE-2026-41179
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-rclone-2026-41179 No score

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Record
BIT-rclone-2026-41179
Updated
2026-11-02
OSVGO-2026-5466 No score

Unauthenticated backend instantiation in github.com/rclone/rclone

The operations/fsinfo remote control (RC) endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it (e.g., via bearer_token_command in webdav or ssh in sftp).

Record
GO-2026-5466
Updated
2026-11-02
OSVMGASA-2026-0147 No score

Updated rclone packages fix security vulnerabilities

This update bring new features, bugs and vulnerabilities fixed in rclone and golang components used to build it.

Record
MGASA-2026-0147
Updated
2026-11-02
OSVopenSUSE-SU-2026:10584-1 No score

rclone-1.73.5-1.1 on GA media

These are all security issues fixed in the rclone-1.73.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10584-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20620-1 No score

Security update for rclone

This update for rclone fixes the following issues:

Changes in rclone:

  • Update to version 1.73.5:

    • Version v1.73.5
    • operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
    • rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
    • rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
    • s3: fix empty delimiter parameter rejected by Archiware P5 server
    • azureblob/auth: add Microsoft Partner Network User-Agent prefix
    • drime: fix User.EntryPermissions JSON unmarshalling
    • filter: fix debug logs that fire before logger is configured - fixes #9291
    • s3: fix TencentCOS CDN endpoint failing on bucket check
    • iclouddrive: fix 'directory not found' error when the directory contains accent marks
    • Start v1.73.5-DEV development

  • Update to version 1.73.4:

    • Version v1.73.4
    • Update to go 1.25.9 to fix multiple CVEs
    • build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
    • docs: fix markdown issues in mount docs
    • docs: fix header level for metadata option
    • fix(docs): Fix link to not be language specific
    • filen: update SDK version
    • build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
    • docs: note macOS 10.15 (Catalina) support with version v1.70.3
    • Start v1.73.4-DEV development

  • Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)

    • Version v1.73.3
    • build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
    • docs/jottacloud: fix broken link
    • docs: clarify Filen password change requires updating both password and API key in rclone config
    • docs: note that Filen API key changes on password change
    • build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
    • s3: add multi tenant support for Cubbit
    • lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
    • list: fix nil pointer panic in Sorter when temp file creation fails
    • docs: update RELEASE procedure to avoid mistakes
    • docs: added text to the label showing version-introduced info
    • Start v1.73.3-DEV development
    • docs: update sponsors

  • Update to version 1.73.2:

    • Version v1.73.2
    • Update to go 1.25.8 to fix multiple CVEs
    • build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
    • docs: fix new drive flag typo in changelog
    • webdav: add missing headers for CORS
    • docs: Document unsupported S3 object keys with double slashes
    • docs: note that --use-server-modtime only works on some backends
    • internxt: fix Entry doesn't belong in directory errors on windows
    • drime: fix chunk-uploaded files ignoring workspace ID
    • docs: Fix headers hierarchy for mount.md
    • webdav: escape reserved characters in URL path segments
    • bisync: add group Sync to the bisync command
    • archive: extract: strip "./" prefix from tar entry paths
    • docs: add instructions on how to update Go version
    • buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
    • Start v1.73.2-DEV development

  • Update to version 1.73.1:

    • Version v1.73.1
    • build: fix build using go 1.26.0 instead of go 1.25.7
    • fs/march: fix runtime: program exceeds 10000-thread limit
    • accounting: fix missing server side stats from core/stats rc
    • pacer: re-read the sleep time as it may be stale
    • pacer: fix deadlock between pacer token and --max-connections
    • build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
    • drime: fix files and directories being created in the default workspace
    • docs: update sponsors
    • copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
    • internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
    • docs: add ExchangeRate-API as a sponsor
    • build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
    • Set list_version to 2 for FileLu S3 configuration
    • filelu: add multipart upload support…
Record
openSUSE-SU-2026:20620-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21436-1 No score

Security update for rclone

This update for rclone fixes the following issues:

Changes in rclone:

  • Update to version 1.74.4 (boo#1267192):

    • Version v1.74.4
    • gui: update embedded release to 1.1.10
    • local: stop --links symlinks escaping the destination directory CVE-2026-54572
    • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
    • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
    • serve restic: fix --private-repos isolation bypass CVE-2026-59733
    • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
    • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
    • build: fix multiple CVEs by upgrading to go1.26.5
    • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
    • drive, googlephotos: warn when using rclone's shared client_id #9580
    • drive: fix stray %!(EXTRA) in unexportable google document log message
    • serve/http: fix --disable-zip so it works over rc
    • serve webdav: fix MOVE overwrite failing without Overwrite header
    • fs: fix negative offset when a suffix Range request exceeds object size
    • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
    • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
    • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
    • cmd/mount2: fix NFS file creation by implementing Mknod
    • smb: fix for IBM iSeries and signature verification
    • mega: fix hard deleted files reappearing in listings - fixes #9554
    • mega: wait for server events after upload, delete and move
    • vfs: fix hang reopening a file during the handle-caching grace period
    • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
    • fs: fix command line flag being ignored when set to its default value
    • docs: fix copy to clipboard functionality for code blocks
    • fs/operations: correct DeleteFile --backup-dir documentation
    • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
    • docs: clarify copyto command description - Fixes #9527
    • docs: fix typo in remote setup docs
    • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
      • s3: fix error mapping in GetObject to match HeadObject
    • filter: fix --files-from copy stopping at the first unreadable file
    • docs: Fix RELEASE.md
    • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
    • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
    • docs/crypt: fix encrypted size example - Fixes #9202
    • docs: drive: note Google verification exemption for personal use apps
    • rc: document that rc API access is equivalent to shell access
    • docs: drive: update documentation about "Computers" folder
    • accounting: fix goroutine leak in ResetCounters
    • docs: fix --windows-event-log-level help
    • backend/filelu: fix recursive listing path handling and file filtering
    • docs: bisync - clarify flag interaction and minor changes
    • docs: Update RELEASE.md to use cherry-pick -x
    • webdav: fix mixed property statuses in multi-status responses
    • s3: remove session token on cross-host redirects
    • drive: warn when non-exportable Google documents are skipped - #9475
    • Start v1.74.4-DEV development

  • update x/image to 0.43 (bsc#1271056)

  • Update to version 1.74.3: (boo#1267869)

    • Bug Fixes
      • rc
        • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
        • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
      • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
        • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
        • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
        • CVE-2026-27145: crypto/x509: split…
Record
openSUSE-SU-2026:21436-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/rclone/rclone
Go
 1.48.0 to 1.73.4
1.73.5
rclone
Alpine:v3.24
 1.48.0 up to 1.73.5-r0
1.73.5-r0
rclone
Bitnami
 1.48.0 up to 1.73.5
1.73.5
rclone
Debian:12
 All versions, plus listed versions
1.60.1+dfsg-21.60.1+dfsg-31.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
rclone
Debian:13
 All versions, plus listed versions
1.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
github.com/rclone/rclone
Go
 1.48.0 up to 1.73.5
1.73.5
github.com/ncw/rclone
Go
 1.48.0 and later None known
github.com/rclone/rclone
Go
 1.49.0 up to 1.73.5
1.73.5
Rclone_jll
Julia
 before 1.73.5+0
1.73.5+0
rclone
Mageia:9
From an advisory covering 31 CVEs
 before 1.73.5-1.1.mga9
1.73.5-1.1.mga9
Show 11 moreShow less
Affected packages
PackageAffectedFixed
rootio-github.com/rclone/rclone
Root:Go
 before v1.69.3-root.io.1
v1.69.3-root.io.1v1.69.3-root.io.2v1.69.3-root.io.3
github.com/rclone/rclone
Root:Go
 before v1.69.3-aikido.2
v1.69.3-aikido.2v1.69.3-aikido.3
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
rclone
Ubuntu:24.04:LTS
 before 1.60.1+dfsg-3ubuntu0.24.04.5, plus listed versions
1.60.1+dfsg-2build11.60.1+dfsg-31.60.1+dfsg-3ubuntu0.24.04.11.60.1+dfsg-3ubuntu0.24.04.21.60.1+dfsg-3ubuntu0.24.04.31.60.1+dfsg-3ubuntu0.24.04.4
1.60.1+dfsg-3ubuntu0.24.04.5
rclone
Ubuntu:25.10
 before 1.60.1+dfsg-4ubuntu2.1, plus listed versions
1.60.1+dfsg-41.60.1+dfsg-4ubuntu11.60.1+dfsg-4ubuntu2
1.60.1+dfsg-4ubuntu2.1
rclone
Ubuntu:26.10
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu31.69.3+dfsg-31.69.3+dfsg-3ubuntu1
 None known
rclone
Ubuntu:26.04:LTS
 before 1.60.1+dfsg-4ubuntu3.1, plus listed versions
1.60.1+dfsg-4ubuntu21.60.1+dfsg-4ubuntu3
1.60.1+dfsg-4ubuntu3.1
rclone
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.73.5-1.1
1.73.5-1.1
rclone
openSUSE:Leap 16.0
From an advisory covering 37 CVEs
 before 1.74.4-bp160.1.1
1.74.4-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubpssec-io/CVE-2026-411792026-06-28
PoC in GitHubs-vx/CVE-2026-411792026-07-27
NucleiRClone RC - Command Injection

History

History
RecordedChangedSources
affected, facts
affected, aliases, exploits, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41179 is a critical vulnerability (CVSS 9.2) in Rclone, published April 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.58%, the 95th percentile. Fixed in github.com/rclone/rclone 1.73.5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 50 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open