opsecsafe — cyber intelligence

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-70460 — rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent. CVSSv3.1 8.1 (HIGH)

CWECWE 22CWECWE 59TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-70458 — rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data. CVSSv3.1 8.2 (HIGH)

CWECWE 787TYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-70456 — rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70456

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory. CVSSv3.1 8.2 (HIGH)

CWECWE 787TYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-70454 — rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70454

rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client. CVSSv3.1 8.0 (HIGH)

CWECWE 295TYPVulnerability

8.0

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-68454 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68454

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of virt_to_phys(page_address(NULL)). CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-53795 — rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process. CVSSv3.1 8.1 (HIGH)

CWECWE 59TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

CRIT

CVE-2026-53791 — rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address. CVSSv3.1 9.1 (CRITICAL)

CWECWE 290TYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-53790 — rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitra CVSSv3.1 8.1 (HIGH)

CWECWE 78CWECWE 88TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-53783 — rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory CVSSv3.1 8.1 (HIGH)

CWECWE 88CWECWE 59TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-19293 — SMP: security request (from peripheral) does not include the maximum encryption key size supported.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19293

SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. CVSSv3.1 8.8 (HIGH)

CWECWE 521VNDSmpTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-19292 — Re-pairing with a legitimate device can use a lower security level than previous making

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19292

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. CVSSv3.1 8.8 (HIGH)

CWECWE 305TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-19291 — Bluetooth: re-pairing with an existing device can use a lower security level.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19291

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below. CVSSv3.1 8.8 (HIGH)

CWECWE 290VNDBluetoothTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 15:19Z

HIGH

CVE-2026-16101 — Spoofing: an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16101

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below CVSSv3.1 8.8 (HIGH)

CWECWE 290VNDSpoofingTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-67986 — amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67986

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. CVSSv3.1 8.4 (HIGH)

CWECWE 94TYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66691 — Broken: Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66691

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. CVSSv3.1 9.8 (CRITICAL)

CWECWE 640VNDBrokenTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-66658 — Subscriber: SQL Injection in Reviewer <= 3.14.2 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66658

Subscriber SQL Injection in Reviewer <= 3.14.2 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDSubscriberTYPVulnerability

8.5

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-66657 — File: Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66657

Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-66656 — File: Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66656

Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-66653 — File: Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66653

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66478 — SQL: Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66478

Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66472 — SQL: Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66472

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66465 — Broken: Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66465

Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDBrokenTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66458 — SQL: Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66458

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

CRIT

CVE-2026-66453 — Broken: Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66453

Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDBrokenTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-08-13

2026-08-13 14:17Z

HIGH

CVE-2026-66450 — File: Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66450

Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-70460 — rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender

CVE-2026-70458 — rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt

CVE-2026-70456 — rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that

CVE-2026-70454 — rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a

CVE-2026-68454 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix

CVE-2026-53795 — rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write

CVE-2026-53791 — rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote

CVE-2026-53790 — rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to

CVE-2026-53783 — rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the

CVE-2026-19293 — SMP: security request (from peripheral) does not include the maximum encryption key size supported.

CVE-2026-19292 — Re-pairing with a legitimate device can use a lower security level than previous making

CVE-2026-19291 — Bluetooth: re-pairing with an existing device can use a lower security level.

CVE-2026-16101 — Spoofing: an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with

CVE-2026-67986 — amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep.

CVE-2026-66691 — Broken: Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

CVE-2026-66658 — Subscriber: SQL Injection in Reviewer <= 3.14.2 versions.

CVE-2026-66657 — File: Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

CVE-2026-66656 — File: Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

CVE-2026-66653 — File: Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

CVE-2026-66478 — SQL: Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

CVE-2026-66472 — SQL: Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

CVE-2026-66465 — Broken: Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

CVE-2026-66458 — SQL: Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

CVE-2026-66453 — Broken: Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

CVE-2026-66450 — File: Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.