Security advisories

medium2026-08-05

CVE-2026-65601-Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

traefik/traefik · GHSA-qq9q-x9w4-chhj

high2026-08-05

CVE-2026-71321-Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

nuxt/nuxt · GHSA-9pgf-384g-p7mv

high2026-08-05

CVE-2026-71320-Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

nuxt/nuxt · GHSA-9473-5f9j-94wq

critical2026-08-05

CVE-2026-71319-Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

nuxt/nuxt · GHSA-279x-mwfv-vcqv

medium2026-08-05

CVE-2026-71318-Nuxt: Unauthorized Component Instantiation via Server Island Props

nuxt/nuxt · GHSA-48hr-524c-v5w3

high2026-08-05

CVE-2026-71316-Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

nuxt/nuxt · GHSA-wm8w-6qjm-cv43

high2026-08-05

CVE-2026-71315-Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

nuxt/nuxt · GHSA-hxvh-4h3w-prp9

high2026-08-05

CVE-2026-71314-Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

nuxt/nuxt · GHSA-hxcr-hm88-mpq6

medium2026-08-05

CVE-2026-71313-rclone: Local Encoding Path Traversal

rclone/rclone · GHSA-7p4m-qxvv-g567

medium2026-08-05

CVE-2026-59732-rclone archive extract allows S3 destination prefix escape via crafted archive paths

rclone/rclone · GHSA-4vr5-p2gc-h23p

low2026-08-05

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

rclone/rclone · GHSA-gx4c-2hqx-cw2r

high2026-08-05

CVE-2026-59733-rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

rclone/rclone · GHSA-fqj9-69pf-6pjg

high2026-08-05

CVE-2026-71312-rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone/rclone · GHSA-2m8m-jhrm-w6j2

medium2026-08-05

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

rclone/rclone · GHSA-h4mf-4v27-hggj

medium2026-08-05

CVE-2026-71311-rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone/rclone · GHSA-8c48-q9wj-3w37

medium2026-08-05

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

rclone/rclone · GHSA-8mxv-9xhp-86h4

medium2026-08-05

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

rclone/rclone · GHSA-8v25-v8p6-qf7v

medium2026-08-05

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

rclone/rclone · GHSA-3x6r-wxxg-53vv

medium2026-08-05

CVE-2026-71310-rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone/rclone · GHSA-xhf4-832v-7xcr

high2026-08-05

CVE-2026-54572-rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

rclone/rclone · GHSA-cf44-9pgv-m4xc