https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:38:09.127945+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-rclone-2026-79779 BIT-rclone-2026-79779 — rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect 2026-10-02T13:38:09.136453+00:00

Affected: Bitnami: rclone

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

 https://cve.radiocsirt.org/vuln/euvd-2026-360181 EUVD-2026-360181 2026-10-02T13:38:09.136510+00:00 EUVD-2026-360181 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79779 fkie_cve-2026-79779 2026-10-02T13:38:09.136528+00:00

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

 https://cve.radiocsirt.org/vuln/ghsa-9mph-vxjp-r3rx GHSA-9mph-vxjp-r3rx 2026-10-02T13:38:09.136552+00:00

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-79779 UBUNTU-CVE-2026-79779 2026-10-02T13:38:09.136568+00:00

Affected: Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2623 WID-SEC-W-2026-2623 — rclone: Mehrere Schwachstellen 2026-10-02T13:38:09.136593+00:00

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.