Security advisories

high2026-08-05

CVE-2026-71309-rclone: Incomplete path validation allows backend root escape in serve restic

rclone/rclone · GHSA-45pq-889g-fcgh

low2026-08-05

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

rclone/rclone · GHSA-945v-v9p3-v5xw

low2026-08-05

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

rclone/rclone · GHSA-gwfq-86j8-7qhv

medium2026-08-05

CVE-2026-70612-Electron: Sandboxed iframes can launch external protocol handlers

electron/electron · GHSA-p2rr-rvmm-c5fp

medium2026-08-05

CVE-2026-70611-Electron: DevTools embedder handler executes arbitrary files via shell open

electron/electron · GHSA-f2r8-jv7c-xqmp

medium2026-08-05

CVE-2026-70610-Electron: contextBridge object copy honors prototype setters

electron/electron · GHSA-ff2p-hmqr-hxm4

medium2026-08-05

CVE-2026-70609-Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

electron/electron · GHSA-4f78-qhmw-8j8m

high2026-08-05

CVE-2026-70608-Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

electron/electron · GHSA-9f4c-93c8-jc8g

medium2026-08-05

CVE-2026-70607-Electron: window.open features string controls some window options considered privileged

electron/electron · GHSA-v93f-fgjr-hjrj

medium2026-08-05

CVE-2026-70606-Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

electron/electron · GHSA-r4w5-6pfg-jxp5

medium2026-08-05

CVE-2026-70605-Electron: HTTP redirect followed into local file loader

electron/electron · GHSA-v64r-4m7r-3mvq

high2026-08-05

CVE-2026-70604-Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

electron/electron · GHSA-v3j7-r9gq-3gjw

medium2026-08-05

CVE-2026-70602-Electron: Extension tab APIs operate across session boundaries

electron/electron · GHSA-m55f-7gqj-fr98

medium2026-08-05

CVE-2026-70603-Electron: shell.openPath path validation bypass via embedded null byte

electron/electron · GHSA-5c9j-mhmv-5xgx

high2026-08-05

CVE-2026-70601-Electron: Context isolation bypass via Function.prototype.bind hijack

electron/electron · GHSA-h7rp-cf8h-j98x

low2026-08-05

CVE-2026-70600-Electron: Cross-origin iframe can position native autofill popup

electron/electron · GHSA-x8rc-wpg4-grpf

medium2026-08-05

CVE-2026-70599-Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

electron/electron · GHSA-9pf5-hg6p-4pwp

medium2026-08-05

CVE-2026-71293-Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

statamic/cms · GHSA-jppw-r5j3-xf7x

low2026-08-05

CVE-2026-70598-Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

electron/electron · GHSA-pfmc-3mgc-p6fp

medium2026-08-05

CVE-2026-70597-Electron: Parent process code-sign check is spoofable

electron/electron · GHSA-jm7p-cc5g-qwxx