{"items":[{"id":"CVE-2026-119741","published":"2026-11-03T15:26:27.533Z","updated":"2026-11-04T14:15:55.669Z","title":"rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions","severity":"HIGH","score":8.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2026-70452","published":"2026-08-13T14:46:50.541Z","updated":"2026-08-14T16:51:18.322Z","title":"rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure","severity":"CRITICAL","score":9.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-70453","published":"2026-08-13T14:46:20.696Z","updated":"2026-08-14T16:51:19.016Z","title":"rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()","severity":"HIGH","score":8.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-70454","published":"2026-08-13T14:45:39.599Z","updated":"2026-08-14T16:51:19.681Z","title":"rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode","severity":"HIGH","score":7.6,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-70455","published":"2026-08-13T14:45:11.164Z","updated":"2026-08-14T19:45:47.934Z","title":"rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion","severity":"HIGH","score":8.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2026-70456","published":"2026-08-13T14:44:56.646Z","updated":"2026-08-14T16:51:20.980Z","title":"rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()","severity":"HIGH","score":8.8,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-70457","published":"2026-08-13T14:44:30.104Z","updated":"2026-08-14T16:51:21.628Z","title":"rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()","severity":"HIGH","score":8.3,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00377,"kevAdded":null},{"id":"CVE-2026-70458","published":"2026-08-13T14:44:06.034Z","updated":"2026-08-14T16:51:22.283Z","title":"rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling","severity":"HIGH","score":8.8,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-70459","published":"2026-08-13T14:43:32.853Z","updated":"2026-08-14T19:45:59.519Z","title":"rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-70460","published":"2026-08-13T14:43:06.250Z","updated":"2026-08-14T16:51:23.590Z","title":"rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink","severity":"CRITICAL","score":9.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-70461","published":"2026-08-13T14:42:49.726Z","updated":"2026-08-14T16:51:24.285Z","title":"rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry","severity":"HIGH","score":8.8,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-70462","published":"2026-08-13T14:42:28.449Z","updated":"2026-08-14T16:51:24.927Z","title":"rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT","severity":"HIGH","score":7.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-70463","published":"2026-08-13T14:42:07.126Z","updated":"2026-08-14T18:09:40.113Z","title":"rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing","severity":"HIGH","score":8.6,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-70464","published":"2026-08-13T14:41:47.987Z","updated":"2026-08-14T16:51:26.225Z","title":"rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall","severity":"HIGH","score":8.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00641,"kevAdded":null},{"id":"CVE-2026-53801","published":"2026-08-13T14:41:27.424Z","updated":"2026-08-14T16:50:15.922Z","title":"rsync < 3.5.0 Symlink Race Condition Directory Traversal","severity":"HIGH","score":8.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-53800","published":"2026-08-13T14:40:57.690Z","updated":"2026-08-14T16:50:15.217Z","title":"rsync < 3.5.0 Symlink Race Condition via --remove-source-files","severity":"MEDIUM","score":5.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-53799","published":"2026-08-13T14:40:45.664Z","updated":"2026-08-14T18:09:48.102Z","title":"rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application","severity":"HIGH","score":7.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00122,"kevAdded":null},{"id":"CVE-2026-53797","published":"2026-08-13T14:40:19.547Z","updated":"2026-08-14T16:50:13.211Z","title":"rsync < 3.5.0 Symlink Race Condition Information Disclosure","severity":"MEDIUM","score":5.7,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-53796","published":"2026-08-13T14:39:46.882Z","updated":"2026-08-14T16:50:12.555Z","title":"rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling","severity":"MEDIUM","score":5.8,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-53795","published":"2026-08-13T14:39:26.044Z","updated":"2026-08-14T20:18:00.445Z","title":"rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest","severity":"HIGH","score":7.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00396,"kevAdded":null},{"id":"CVE-2026-53794","published":"2026-08-13T14:39:01.158Z","updated":"2026-08-14T16:50:11.227Z","title":"rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00507,"kevAdded":null},{"id":"CVE-2026-53793","published":"2026-08-13T14:38:42.288Z","updated":"2026-08-14T16:50:10.544Z","title":"rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode","severity":"CRITICAL","score":9.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-53792","published":"2026-08-13T14:38:30.864Z","updated":"2026-08-14T16:50:09.868Z","title":"rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block","severity":"HIGH","score":7.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-53791","published":"2026-08-13T14:38:10.300Z","updated":"2026-08-14T18:09:56.975Z","title":"rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header","severity":"CRITICAL","score":9.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-53790","published":"2026-08-13T14:37:41.052Z","updated":"2026-08-14T16:50:08.531Z","title":"rsync < 3.5.0 Command Injection via Multiple Code Paths","severity":"CRITICAL","score":9.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2026-53789","published":"2026-08-13T14:37:14.035Z","updated":"2026-08-15T03:18:32.156Z","title":"rsync < 3.5.0 Arbitrary File Deletion via Malicious File List","severity":"HIGH","score":7.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-53788","published":"2026-08-13T14:36:43.279Z","updated":"2026-08-14T16:50:07.165Z","title":"rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-53798","published":"2026-08-13T14:36:00.537Z","updated":"2026-08-14T16:50:13.878Z","title":"rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-53786","published":"2026-08-13T14:35:34.378Z","updated":"2026-08-14T20:18:10.931Z","title":"rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-53785","published":"2026-08-13T14:34:59.757Z","updated":"2026-08-14T16:50:05.802Z","title":"rsync < 3.5.0 Path Traversal Write Escape via --relative Mode","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-53784","published":"2026-08-13T14:34:22.543Z","updated":"2026-08-15T03:17:19.548Z","title":"rsync < 3.5.0 Path Traversal via Symlink Module Root","severity":"HIGH","score":8.4,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-53783","published":"2026-08-13T14:34:07.144Z","updated":"2026-08-14T16:50:04.494Z","title":"rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync","severity":"HIGH","score":8.6,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-53803","published":"2026-08-13T14:33:18.552Z","updated":"2026-08-14T16:50:17.210Z","title":"rsync < 3.5.0 Symlink Following Arbitrary File Overwrite","severity":"HIGH","score":8.5,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-53802","published":"2026-08-13T14:32:26.170Z","updated":"2026-08-14T16:50:16.559Z","title":"rsync < 3.5.0 Arbitrary File Read via Symlink Following","severity":"HIGH","score":8.4,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-29518","published":"2026-05-20T12:48:07.656Z","updated":"2026-09-01T12:04:58.665Z","title":"Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write","severity":"HIGH","score":7.3,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-43617","published":"2026-05-20T00:52:38.965Z","updated":"2026-07-14T20:01:04.353Z","title":"Rsync < 3.4.3 Authorization Bypass via Hostname Resolution","severity":"MEDIUM","score":6.3,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-43618","published":"2026-05-20T00:50:21.416Z","updated":"2026-09-01T12:04:49.098Z","title":"Rsync < 3.4.3 Integer Overflow Information Disclosure","severity":"MEDIUM","score":6.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.0078,"kevAdded":null},{"id":"CVE-2026-43619","published":"2026-05-20T00:49:14.709Z","updated":"2026-07-14T20:01:06.821Z","title":"Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls","severity":"HIGH","score":7.2,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-43620","published":"2026-05-20T00:47:57.086Z","updated":"2026-07-14T20:01:07.518Z","title":"Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()","severity":"MEDIUM","score":6.9,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-45232","published":"2026-05-20T00:45:28.540Z","updated":"2026-07-14T21:32:51.080Z","title":"Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy","severity":"LOW","score":2.1,"vendor":"RsyncProject","product":"rsync","kev":false,"epss":0.00337,"kevAdded":null}]}