{"id":"CVE-2026-49980","aliases":["BIT-rclone-2026-49980","DEBIAN-CVE-2026-49980","EUVD-2026-39018","GHSA-qw24-gh76-8rvv","GO-2026-5596","ROOT-APP-GOBINARY-CVE-2026-49980","SUSE-SU-2026:23625-1","UBUNTU-CVE-2026-49980","USN-8782-1","openSUSE-SU-2026:10975-1","openSUSE-SU-2026:21436-1","openSUSE-SU-2026:21761-1"],"status":"published","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00781,"percentile":0.56266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306","CWE-78"],"published":"2026-06-08T00:00:00Z","modified":"2026-11-09T12:49:54Z","fixes":[{"ecosystem":"Go","package":"github.com/rclone/rclone","fixed_in":["1.74.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rclone","fixed_in":["1.74.3"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/rclone/rclone","fixed_in":["v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.3","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.4","v1.69.3-aikido.3","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.1","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.2","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","fixed_in":["v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.3","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.4","v1.69.3-root.io.3","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.1","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.2","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rclone","fixed_in":["1.53.3-4ubuntu1.22.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rclone","fixed_in":["1.60.1+dfsg-3ubuntu0.24.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rclone","fixed_in":["1.60.1+dfsg-4ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.46.0"},{"last_affected":"1.74.2"},{"fixed":"1.74.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.46.0"},{"fixed":"1.74.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2","1.60.1+dfsg-3","1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.46.0"},{"fixed":"1.74.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.49.0"},{"fixed":"1.74.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ncw/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.46.0"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.4"},{"fixed":"v1.69.3-aikido.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.1"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.2"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.4"},{"fixed":"v1.69.3-root.io.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.1"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.2"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.47.0+ex1-6","1.47.0+ex1-7","1.49.5-2","1.49.5-3","1.50.2-2","1.50.2-2ubuntu0.1","1.50.2-2ubuntu0.2","1.50.2-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.3-4ubuntu1.22.04.5"}]}],"versions":["1.53.3-1","1.53.3-2","1.53.3-4","1.53.3-4ubuntu1","1.53.3-4ubuntu1.22.04.1","1.53.3-4ubuntu1.22.04.2","1.53.3-4ubuntu1.22.04.3","1.53.3-4ubuntu1.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-3ubuntu0.24.04.6"}]}],"versions":["1.60.1+dfsg-2build1","1.60.1+dfsg-3","1.60.1+dfsg-3ubuntu0.24.04.1","1.60.1+dfsg-3ubuntu0.24.04.2","1.60.1+dfsg-3ubuntu0.24.04.3","1.60.1+dfsg-3ubuntu0.24.04.4","1.60.1+dfsg-3ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4","1.60.1+dfsg-4ubuntu1","1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu3","1.69.3+dfsg-3","1.69.3+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-4ubuntu3.2"}]}],"versions":["1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu3","1.60.1+dfsg-4ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.3-4ubuntu1.22.04.5"}]}],"versions":["1.53.3-1","1.53.3-2","1.53.3-4","1.53.3-4ubuntu1","1.53.3-4ubuntu1.22.04.1","1.53.3-4ubuntu1.22.04.2","1.53.3-4ubuntu1.22.04.3","1.53.3-4ubuntu1.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-3ubuntu0.24.04.6"}]}],"versions":["1.60.1+dfsg-2build1","1.60.1+dfsg-3","1.60.1+dfsg-3ubuntu0.24.04.1","1.60.1+dfsg-3ubuntu0.24.04.2","1.60.1+dfsg-3ubuntu0.24.04.3","1.60.1+dfsg-3ubuntu0.24.04.4","1.60.1+dfsg-3ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-4ubuntu3.2"}]}],"versions":["1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu3","1.60.1+dfsg-4ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.3-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-bp160.1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181}],"products":[{"vendor":"rclone","product":"rclone"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"openshift api for data protection"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"}],"references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49980","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492478","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.json","tags":["x_sadp-csaf-vex","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49980","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qw24-gh76-8rvv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49980.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49980","tags":["advisory"]},{"url":"https://github.com/rclone/rclone","tags":["package"]},{"url":"https://github.com/rclone/rclone/commit/48da1774f4999d1d46543308b9a7fe75585dbfc4","tags":["fix"]},{"url":"https://github.com/rclone/rclone/commit/9222ed2c5a7678de7fa620214b0858311c707a29","tags":["fix"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623625-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77354","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-49980","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49980","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8782-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42507","tags":["web"]},{"url":"https://bugzilla.suse.com/1262438","tags":["report"]},{"url":"https://bugzilla.suse.com/1262439","tags":["report"]},{"url":"https://bugzilla.suse.com/1266210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267192","tags":["report"]},{"url":"https://bugzilla.suse.com/1267869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-49980","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T17:52:33.024Z","modified":"2026-08-10T12:05:48.128Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-39018","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T17:52:33Z","modified":"2026-08-10T12:05:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-qw24-gh76-8rvv","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"## Summary\n\n`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:\n\n```text\n/[remote:path]/object\n```\n\nThe `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.\n\nVersions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under \"Additional impact\" but not to command execution, because inline backend option overrides did not exist until 1.55.0.\n\n## Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n- The `--rc-serve` flag must be in use\n\n## Impact\n\nAn unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.\n\nAdditional impact observed during testing:\n\n- `GET` and `HEAD` both trigger backend initialization.\n- The same path allows unauthenticated local file read through inline `local` remotes.\n- Inline `global.*` options can mutate process-wide rclone configuration, including `global.http_proxy`.\n- Browser subresource requests can also trigger the issue against a localhost-only RC listener. In testing, Firefox triggered the payload from a public HTTPS page containing only an `\u003cimg\u003e` tag pointing at `http://127.0.0.1:5572/...`. This is an additional impact multiplier, not the primary attack precondition.\n\n## Mitigations / Workarounds\n\n- Upgrade to rclone 1.74.3 (or 1.75.0 when released).\n- Or, configure HTTP authentication on the rc with `--rc-user`/`--rc-pass`\n  or `--rc-htpasswd`, which has always been the recommended deployment.\n- Or, do not use `--rc-serve` if file serving is not needed.\n\n## The Fix\n\nThe vulnerabilities in this advisory have been fixed by two commits:\n\n- rc: fix unauthenticated command execution via `--rc-serve` inline remotes\n- rc: stop `global.*` connection string options changing config","status":"published","published":"2026-06-16T23:39:41Z","modified":"2026-07-21T13:16:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-02T14:40:49.410128Z"}],"nvd":[{"id":"CVE-2026-49980","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T19:17:11.597Z","modified":"2026-08-07T12:18:00.47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T14:12:25.67873Z"}],"osv":[{"id":"CVE-2026-49980","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T17:52:33.024Z","modified":"2026-10-28T02:30:27.622085837Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49980","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T19:17:11.597Z","modified":"2026-10-01T03:03:16.934201002Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-qw24-gh76-8rvv","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"## Summary\n\n`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:\n\n```text\n/[remote:path]/object\n```\n\nThe `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.\n\nVersions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under \"Additional impact\" but not to command execution, because inline backend option overrides did not exist until 1.55.0.\n\n## Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n- The `--rc-serve` flag must be in use\n\n## Impact\n\nAn unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.\n\nAdditional impact observed during testing:\n\n- `GET` and `HEAD` both trigger backend initialization.\n- The same path allows unauthenticated local file read through inline `local` remotes.\n- Inline `global.*` options can mutate process-wide rclone configuration, including `global.http_proxy`.\n- Browser subresource requests can also trigger the issue against a localhost-only RC listener. In testing, Firefox triggered the payload from a public HTTPS page containing only an `\u003cimg\u003e` tag pointing at `http://127.0.0.1:5572/...`. This is an additional impact multiplier, not the primary attack precondition.\n\n## Mitigations / Workarounds\n\n- Upgrade to rclone 1.74.3 (or 1.75.0 when released).\n- Or, configure HTTP authentication on the rc with `--rc-user`/`--rc-pass`\n  or `--rc-htpasswd`, which has always been the recommended deployment.\n- Or, do not use `--rc-serve` if file serving is not needed.\n\n## The Fix\n\nThe vulnerabilities in this advisory have been fixed by two commits:\n\n- rc: fix unauthenticated command execution via `--rc-serve` inline remotes\n- rc: stop `global.*` connection string options changing config","status":"published","published":"2026-06-16T23:39:41Z","modified":"2026-09-10T03:50:50.290908238Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2026-49980","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-24T19:17:00Z","modified":"2026-11-09T12:49:54.391511782Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"BIT-rclone-2026-49980","title":"Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.","status":"published","published":"2026-06-30T23:50:55.025Z","modified":"2026-09-08T08:48:18.92681578Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"GO-2026-5596","title":"Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone","description":"The --rc-serve path in rclone allows unauthenticated remote instantiation, enabling unauthenticated command execution. An attacker can use inline remote backend options such as sftp ssh to run arbitrary commands as the rclone user.","status":"published","published":"2026-08-11T23:21:06Z","modified":"2026-08-14T15:42:04.05418967Z","updated_at":"2026-11-02T15:47:02.556545Z"},{"id":"openSUSE-SU-2026:10975-1","title":"rclone-1.74.3-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.74.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-08T00:00:00Z","modified":"2026-06-09T09:00:07.440561032Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21436-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.74.4 (boo#1267192):\n  * Version v1.74.4\n  * gui: update embedded release to 1.1.10\n  * local: stop --links symlinks escaping the destination directory CVE-2026-54572\n  * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw\n  * s3: strip STS security token on same-host HTTPS-\u003eHTTP redirect GHSA-cf44-9pgv-m4xc\n  * serve restic: fix --private-repos isolation bypass CVE-2026-59733\n  * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732\n  * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v\n  * build: fix multiple CVEs by upgrading to go1.26.5\n  * s3: fix mounting a prefix failing with 403 when HEAD is not permitted\n  * drive, googlephotos: warn when using rclone's shared client_id #9580\n  * drive: fix stray %!(EXTRA) in unexportable google document log message\n  * serve/http: fix --disable-zip so it works over rc\n  * serve webdav: fix MOVE overwrite failing without Overwrite header\n  * fs: fix negative offset when a suffix Range request exceeds object size\n  * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs\n  * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets\n  * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers\n  * cmd/mount2: fix NFS file creation by implementing Mknod\n  * smb: fix for IBM iSeries and signature verification\n  * mega: fix hard deleted files reappearing in listings - fixes #9554\n  * mega: wait for server events after upload, delete and move\n  * vfs: fix hang reopening a file during the handle-caching grace period\n  * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391\n  * fs: fix command line flag being ignored when set to its default value\n  * docs: fix copy to clipboard functionality for code blocks\n  * fs/operations: correct DeleteFile --backup-dir documentation\n  * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities\n  * docs: clarify copyto command description - Fixes #9527\n  * docs: fix typo in remote setup docs\n  * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188\n  * * s3: fix error mapping in GetObject to match HeadObject\n  * filter: fix --files-from copy stopping at the first unreadable file\n  * docs: Fix RELEASE.md\n  * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0\n  * completion: fix powershell completion corrupting non-ASCII names - fixes #9412\n  * docs/crypt: fix encrypted size example - Fixes #9202\n  * docs: drive: note Google verification exemption for personal use apps\n  * rc: document that rc API access is equivalent to shell access\n  * docs: drive: update documentation about \"Computers\" folder\n  * accounting: fix goroutine leak in ResetCounters\n  * docs: fix --windows-event-log-level help\n  * backend/filelu: fix recursive listing path handling and file filtering\n  * docs: bisync - clarify flag interaction and minor changes\n  * docs: Update RELEASE.md to use cherry-pick -x\n  * webdav: fix mixed property statuses in multi-status responses\n  * s3: remove session token on cross-host redirects\n  * drive: warn when non-exportable Google documents are skipped - #9475\n  * Start v1.74.4-DEV development\n\n- update x/image to 0.43 (bsc#1271056)\n\n- Update to version 1.74.3: (boo#1267869)\n  - Bug Fixes\n    - rc\n      - Fix unauthenticated command execution via --rc-serve inline\n        remotes CVE-2026-49980 (Nick Craig-Wood)\n      - Stop global.* connection string options changing config\n        CVE-2026-49980 (Nick Craig-Wood)\n    - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick\n      Craig-Wood)\n      - CVE-2026-42504: mime: quadratic complexity in\n        WordDecoder.DecodeHeader\n      - CVE-2026-42507: net/textproto: arbitrary input are included\n        in errors without any escaping\n      - CVE-2026-27145: crypto/x509: split candidate hostname only\n        once\n    - log: Fix wrong source file:line in JSON logs from release\n      builds (Nick Craig-Wood)\n    - mount2: Fix empty directory listings on re-read (Janne Beate\n      Bakeng)\n    - serve s3: Fix multipart ListParts pagination returning wrong\n      part numbers (Nick Craig-Wood)\n    - serve sftp\n      - Fix file corruption when a client resumes an upload (Nick\n        Craig-Wood)\n      - Fix truncate request being silently ignored (Nick\n        Craig-Wood)\n    - Local\n      - Fix getXattr returning empty map instead of nil (Leon\n        Brocard)\n  - Drime\n    - Fix server-side copy and move failing with Cloudflare 520\n      error (Nick Craig-Wood)\n    - Fix files being uploaded to the wrong directory (Nick\n      Craig-Wood)\n    - Remove duplicate upload_cutoff config option (Nick\n      Craig-Wood)\n    - Fix directory rename leaving the renamed folder empty in VFS\n      (Nick Craig-Wood)\n  - Drive\n    - Fix server-side move failing on shared drives with duplicate\n      dirs (Nick Craig-Wood)\n  - Iclouddrive\n    - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)\n    - Fix \"Index has invalid data\" error listing iCloud Photos\n      (Nick Craig-Wood)\n\n- Update to version 1.74.2: (boo#1266210)\n  - Bug Fixes\n    - build\n      - Update golang.org/x/net to v0.55.0 to address:\n        - CVE-2026-42506: html: incorrect handling of namespaced\n          elements in foreign content\n        - CVE-2026-39821: idna: failure to reject ASCII-only\n          Punycode-encoded labels\n        - CVE-2026-42502: html: incorrect handling of HTML elements\n          in foreign content\n        - CVE-2026-25680: html: denial of service when parsing\n          arbitrary HTML\n        - CVE-2026-25681: html: incorrect handling of character\n          references in DOCTYPE nodes\n        - CVE-2026-27136: html: duplicate attributes can cause XSS\n      - Update golang.org/x/crypto to v0.52.0 to address:\n        - CVE-2026-46598: ssh/agent: pathological inputs can lead\n          to client panic\n        - CVE-2026-46597: ssh: byte arithmetic causes underflow and\n          panic\n        - CVE-2026-39828: ssh: bypass of certificate restrictions\n        - CVE-2026-39835: ssh: server panic during\n          CheckHostKey/Authenticate\n        - CVE-2026-39833: ssh/agent: key constraints not enforced\n        - CVE-2026-39832: ssh/agent: agent constraints dropped when\n          forwarding keys\n        - CVE-2026-39827: ssh: memory leak when rejecting channels\n          can lead to DoS\n        - CVE-2026-39830: ssh: client can cause server deadlock on\n          unexpected responses\n        - CVE-2026-39829: ssh: pathological RSA/DSA parameters may\n          cause DoS\n        - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys\n          physical interaction\n        - CVE-2026-39834: ssh: infinite loop on large channel\n          writes\n        - CVE-2026-42508: ssh/knownhosts: auth bypass via\n          unenforced @revoked status\n        - CVE-2026-46595: ssh: VerifiedPublicKeyCallback\n          permissions skip enforcement\n      - update golang.org/x/image to v0.41.0 to address:\n        - CVE-2026-42500: bmp: panic when reading out of bound\n          palette index\n        - CVE-2026-33809: tiff: excessive resource consumption in\n          PackBits decompression\n      - Update golang.org/x/sys to version v0.45.0 to address:\n        - CVE-2026-39824: windows: integer overflow in\n          NewNTUnicodeString\n      - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix\n        CVE-2026-44740\n      - bisync: Fix --conflict-loser pathname with\n        --conflict-resolve newer (nielash)\n      - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)\n      - lib/http: Replace deprecated h2c.NewHandler with\n        http.Server.Protocols (Nick Craig-Wood)\n      - rc: Remove duplicate metrics_addr option registration (Nick\n        Craig-Wood)\n      - vfs/vfscache: Fix silent write failure when mounting with\n        remote:. (Lucky945H)\n    - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)\n  - Drime\n    - Fix file doesn't exists error when trying to delete (John\n      Volk)\n    - Fix 500 errors when listing shared folders (Alvinwylim)\n  - Jottacloud\n    - Support whitelabel service Phonero Sky (Tore Anderson)\n  - Protondrive\n    - Fix corrupted on transfer: sha1 hashes differ (William Tange)\n  - S3\n    - Add new MEGA S4 endpoints on megas4.com including\n      Asia-Pacific region (Nick Craig-Wood)\n  - WebDAV\n    - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)\n\n- Update to version 1.74.1:\n  * Version v1.74.1\n  * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814\n  * build: fix multiple CVEs by upgrading to go1.26.3\n  * drime: fix uploads of 100..200M files\n  * drime: fix large file uploads landing in drive root instead of configured folder\n  * docs: sponsor updates\n  * s3: add new Fastly Object Storage regions\n  * cloudinary: fix retrying every error and fix pacer sleep units\n  * s3: fix STS call per request by caching AssumeRole credentials\n  * protondrive: fix segfault when copying files missing revision metadata\n  * protondrive: route library logging through rclone's logger\n  * protondrive: route HTTP through rclone's transport\n  * bisync: fix retryable without --resync error message when --resync has a critical failure\n  * cmd/serve/s3: return object listings in key order\n  * Start v1.74.1-DEV development\n\n- Update to version 1.74.0:\n  * Version v1.74.0\n  * docs: add missing Huawei Drive docs\n  * Add Huawei Drive support\n  * s3: add Impossible Cloud as a new S3 provider\n  * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI\n  * gui: embed compressed dist.zip in the binary for smaller, reproducible builds\n  * docs: update the GUI docs to reflect the new `rclone gui`\n  * Add John Volk to contributors\n  * drime: fix listings of large directories\n  * docs: fix iCloud docs after website update (missed in the merge)\n  * protondrive: fix server-side moveto and DirMove against current API\n  * build: Update all packages with pseudo versions which aren't v0.0.0\n  * Add Chris Coughlan to contributors\n  * Add Yakov Till to contributors\n  * iclouddrive: add read only  iCloud Photos support and SRP authentication\n  * mountlib: rc: fix mounts created with mountPoint \"*\" overwriting each other\n  * vfs/vfscache/downloaders: kick waiters periodically, not just once\n  * rc: add user directories to core/disks and filter mounts better\n  * docs: notes on how to update pseudo versions\n  * Add dlaumen to contributors\n  * Add Luke Cyca to contributors\n  * Add mathieulongtin to contributors\n  * protondrive: update to latest go-proton-api to use new host\n  * docs: amend Google Drive client_id instructions to include running web-based auth flow\n  * azureblob,azurefile: fix documentation about federated identity\n  * internxt: implement multi-part uploads\n  * serve dlna: remove file extensions from titles to prevent Samsung TV duplication\n  * serve dlna: fix XML quote escaping for Samsung TV compatibility\n  * serve dlna: handle empty ObjectID from Samsung TVs\n  * serve dlna: add Samsung-specific XML namespace\n  * serve dlna: fix invalid dc:date for containers\n  * serve dlna: fix container childCount to reflect actual contents\n  * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility\n  * Add Anton Bordwine to contributors\n  * listremotes: add --exact flag for filtering - fixes #9076\n  * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952\n  * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367\n  * Add tdawe to contributors\n  * Add Jan Heylen to contributors\n  * protondrive: align backend with newer Proton SDK stack\n  * s3: fix bucket creation failing on Ceph/radosgw\n  * rc: add core/disks to enumerate attached disks\n  * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813\n  * Add SyoBoN to contributors\n  * docs: fix typo\n  * docs: fix code comment regarding cmount tag\n  * s3: add HCP provider and list_versions_oldest_first quirk\n  * mega: fix crash when logging in with previous auth keys fails\n  * pcloud: fix recursive listing from the root - fixes #9315\n  * rc: flip auth default so all endpoints require auth unless opted out\n  * Changelog updates from Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * accounting: fix rcat/copyurl for files.com\n  * bisync: fix integration tests after sftp log changes\n  * build: bump actions/github-script from 8 to 9\n  * fstest/test_all: stop test servers on signal, panic, or exit\n  * fstest/testserver: add CleanupAll for end-of-run server sweep\n  * fstest/testserver: add force-stop and reconcile stale refcounts\n  * fshttp: add --dump curl for dumping HTTP requests as curl commands\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * serve nfs: fix EOF flag in READ response not being set when read reaches end of file\n  * webdav: optimize performance by using Depth=0 for metadata requests\n  * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy\n  * azureblob: add --azureblob-decompress flag to download gzip-encoded files\n  * docs: serve backend metadata as JSON on the website\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * vfs: add context parameter to New() for config propagation\n  * vfs: replace context.TODO/Background with stored VFS context\n  * build: fix `make fetch-gui` in CI workflow - it was in the wrong place\n  * gui: join Wait goroutines on shutdown\n  * gui: remove flag.Lookup test guard around browser open\n  * gui: drop freePort helper, use libhttp port binding for the RC server\n  * gui: allow serving from a local zip file or an unpacked directory\n  * gui: don't run fetch-gui on make\n  * build: fix GitHub API rate limit errors when fetching GUI dist in CI\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filen: make multi-threaded upload chunks individually retryable\n  * chore: add Enduriel as filen backend maintainer\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * Add Mozi to contributors\n  * Add Brais Couce to contributors\n  * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * downloaders: fix flaky TestDownloaders/EnsureDownloader test\n  * sftp: warn the user if no host key validation is configured\n  * Add TheBabu to contributors\n  * lib/http: Add HTTP/2 cleartext support in server configuration\n  * build: add explicit permissions to GitHub Actions workflows\n  * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file\n  * webdav: Add a section on symlink/junction points in the help\n  * Changelog updates from Version v1.73.4\n  * build: update all dependencies\n  * docs: fix XSS vulnerability in dropdown mobile header\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * linkbox: fix downloading files by using web API - fixes #8665\n  * vfs: fix tests after --vfs-handle-caching\n  * Add Suyun to contributors\n  * build: fix loong64 and s390x build\n  * jottacloud: add encoding of percent character to default backend encoding\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * vfs: fix slow nfs serve by adding --vfs-handle-caching\n  * Add Xiangzhe to contributors\n  * Add Mike GIllan to contributors\n  * fix(docs): Fix link to not be language specific\n  * iclouddrive: lowercase Apple ID for SRP authentication\n  * iclouddrive: use dynamic origin for SRP auth headers\n  * iclouddrive: replace plaintext signin with SRP authentication\n  * docs: modernize rclone.org site design\n  * Add Andriy Senyshyn to contributors\n  * Add Claude Opus 4.6 to contributors\n  * Add jinyu.han to contributors\n  * Add jinkeyuu to contributors\n  * Add lif to contributors\n  * Add BizaNator to contributors\n  * Add Patrick Farrell to contributors\n  * Add Jason to contributors\n  * Add ZRHan to contributors\n  * Add Andrew Furman to contributors\n  * Add Andriy Senyshyn to contributors\n  * Add Bhagyashreek8 to contributors\n  * s3: add UCloud Object Storage provider (#9230)\n  * bisync: fix handling of unreadable lockfiles - fixes #9290\n  * librclone/ctest: add Windows support and fix memory management\n  * s3: fix regression where PutObject fails with non-seekable readers\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Add OVHcloud storage classes\n  * local: remove fadvise calls that cause spinlock contention\n  * Changelog updates from Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * webdav: request only required properties in listAll to improve performance\n  * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * copyurl: fix ignored --upload-headers and --download-headers\n  * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * Add Billy Hughes to contributors\n  * accounting: Add deletedDirs stat to core/stats help output\n  * docs: added text to the label showing version-introduced info\n  * Changelog updates from Version v1.73.2\n  * fs/log: fix data race on OutputHandler.format field\n  * build(deps): bump docker/build-push-action from 6 to 7\n  * build(deps): bump docker/setup-buildx-action from 3 to 4\n  * build(deps): bump docker/metadata-action from 5 to 6\n  * build(deps): bump docker/setup-qemu-action from 3 to 4\n  * build(deps): bump docker/login-action from 3 to 4\n  * bisync: update changelog\n  * bisync: auto-generate rc help docs\n  * bisync: add more structured info to rc output\n  * bisync: add missing rc params - fixes #7799\n  * operations: multithread copy: grab memory before making go routines\n  * b2: add server side copy real time accounting\n  * s3: add server side copy real time accounting\n  * azureblob: add server side copy real time accounting\n  * operations: add method to real time account server side copy\n  * Add Duncan F to contributors\n  * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency\n  * Add razorloves to contributors\n  * docs: fix new drive flag typo in changelog\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * Add Bjoern Franke to contributors\n  * Add Brian Bockelman to contributors\n  * Add Romāns Potašovs to contributors\n  * Add Adam Kasztenny to contributors\n  * Add hxnd to contributors\n  * Add Bjoern Franke to contributors\n  * Add FTCHD to contributors\n  * build(deps): bump actions/upload-artifact from 6 to 7\n  * build(deps): bump actions/download-artifact from 7 to 8\n  * serve http: add gzip compression\n  * webdav: permit redirects on PROPFIND for metadata\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * touch: add metadata when using `--metadata-set`\n  * s3: ionos: updated regions \u0026 endpoints\n  * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR\n  * drive: add integration test for handling folder names with single quotes\n  * http: dark mode for browser\n  * docs: note that --use-server-modtime only works on some backends\n  * Add a1pcm to contributors\n  * Add Leon Brocard to contributors\n  * Add Dark Dragon to contributors\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * s3: add new Fastly Object Storage regions\n  * docs: Fix headers hierarchy for mount.md\n  * serve http: add fallback embedded favicon\n  * graphics: optimise images losslessly with ImageOptim\n  * docs: update sponsors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Chris to contributors\n  * Add Shlomi Avihou to contributors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Varun Chawla to contributors\n  * Add Prakhar Chhalotre to contributors\n  * s3: add Object Lock support\n  * webdav: escape reserved characters in URL path segments\n  * s3: add Zadara Object Storage provider\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * accounting: update String method output format for clarity in transfer rate representation - fixes #9129\n  * docs: add instructions on how to update Go version\n  * build: modernize Go code with go fix for go1.25\n  * build: update all dependencies\n  * lib/rest: remove go1.24 workaround now go1.25 is the minimum\n  * build: update to go1.26 and make go1.25 the minimum required version\n  * Add Jack Kelly to contributors\n  * Changelog updates from Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * test_all: increase retries for Internxt eventual consistency\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * Add kingston125 to contributors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * filelu: migrate API calls to lib/rest\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * Add Cohinem to contributors\n  * Add Leon Brocard to contributors\n  * s3: remove StackPath Object Storage provider\n  * drime: implement About\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * s3: add Fastly Object Storage provider\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * pikpak: support custom filenames for addurl backend command - fixes #9111\n  * Start v1.74.0-DEV development\n","status":"published","published":"2026-07-22T20:54:49Z","modified":"2026-07-24T17:16:08.404400958Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21761-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:30:23Z","modified":"2026-09-09T18:23:14.573173825Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-49980","title":"CVE-2026-49980 in github.com/rclone/rclone - Patched by Root","description":"Root has patched CVE-2026-49980 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-05T05:53:21Z","modified":"2026-10-05T06:15:05.425714319Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:23625-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:32:03Z","modified":"2026-09-29T18:23:20.110594263Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-8782-1","title":"rclone vulnerability","description":"It was discovered that Rclone incorrectly handled unauthenticated requests\nto the remote control API. An attacker could possibly use this issue to\nexecute arbitrary commands as the user invoking rclone. (CVE-2026-49980)","status":"published","published":"2026-09-18T10:37:23Z","modified":"2026-09-18T18:41:44.29888799Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}