Latest high and critical flaws
- CVE-2026-70464 rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stHigh 8.7 · Aug 13, 2026
- CVE-2026-70463 rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing.High 8.6 · Aug 13, 2026
- CVE-2026-70462 rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connectHigh 7.1 · Aug 13, 2026
- CVE-2026-70461 rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte paHigh 8.8 · Aug 13, 2026
- CVE-2026-70460 rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the moduCritical 9.2 · Aug 13, 2026
- CVE-2026-70458 rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entriHigh 8.8 · Aug 13, 2026
- CVE-2026-70457 rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segmeHigh 8.3 · Aug 13, 2026
- CVE-2026-70456 rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memorHigh 8.8 · Aug 13, 2026
- CVE-2026-70455 rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias fHigh 8.7 · Aug 13, 2026
- CVE-2026-70454 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attacHigh 7.6 · Aug 13, 2026
- CVE-2026-70453 rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by High 8.7 · Aug 13, 2026
- CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution Critical 9.1 · Aug 13, 2026
- CVE-2026-53803 rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable outHigh 8.5 · Aug 13, 2026
- CVE-2026-53802 rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlinHigh 8.4 · Aug 13, 2026
- CVE-2026-53801 rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumeraHigh 8.2 · Aug 13, 2026
- CVE-2026-53799 rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to High 7.2 · Aug 13, 2026
- CVE-2026-53795 rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an abHigh 7.2 · Aug 13, 2026
- CVE-2026-53793 rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructCritical 9.1 · Aug 13, 2026
- CVE-2026-53792 rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory accesHigh 7.1 · Aug 13, 2026
- CVE-2026-53791 rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sendiCritical 9.1 · Aug 13, 2026
- CVE-2026-53790 rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious inCritical 9.2 · Aug 13, 2026
- CVE-2026-53789 rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intendeHigh 7.1 · Aug 13, 2026
- CVE-2026-53784 rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disablHigh 8.4 · Aug 13, 2026
- CVE-2026-53783 rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticateHigh 8.6 · Aug 13, 2026
- CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writesHigh 7.3 · May 20, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.