CVE Vulnerability Catalog

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

NI SystemLink contains a storage of sensitive information in cleartext vulnerability. An attacker with local access may obtain sensitive information stored by the system in the clear. This affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

An improper access control vulnerability in NI SystemLink may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. Affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.

The WP Fast Total Search WordPress plugin in versions up to 1.82.284 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.

The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The WPCS WordPress plugin in versions up to 1.3.2 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The SiteSkite plugin in versions up to 2.1.5 contains a Privilege Escalation vulnerability. An unauthenticated attacker can elevate their privileges.

The ZHBackup – Backup, Restore & Migration plugin in versions up to 2.4.2 contains a Sensitive Data Exposure vulnerability. An unauthenticated attacker can access sensitive data.

The RepairBuddy plugin in versions up to 4.1224 contains a Remote Code Execution (RCE) vulnerability. An attacker with subscriber privileges can execute code remotely.

The WP-Stateless plugin in versions up to 4.4.1 contains a Settings Change vulnerability. An attacker with subscriber privileges can change plugin settings.

The Return Refund and Exchange For WooCommerce plugin in versions up to 4.6.4 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.

The WP Travel plugin for WordPress (up to version 12.0.3) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows password recovery exploitation. An attacker can reset a victim's password without their knowledge.

The Page Visits Counter – Lite plugin in versions up to 1.2.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The Shirt Product Designer for WooCommerce plugin in version 1.0.4 contains a broken access control flaw that allows an unauthenticated attacker to perform operations they should not be authorized to do.