rclone: http backend forwards custom/auth headers to a different host on redirect

CVE-2026-88013

## Vulnerability Details **File**: `backend/http/http.go` **Lines**: 285 (client construction — no `CheckRedirect`), 50

历史摘要 · 未重新核验 · GitHub Advisory

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

CVE-2026-88016

## Summary With `-l/--links`, rclone's local backend recreates a source `.rclonelink` object as a real symlink at the de

历史摘要 · 未重新核验 · GitHub Advisory

rclone local: crafted Range request against a translated symlink panics (DoS)

CVE-2026-88015

### Summary When `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is expose

历史摘要 · 未重新核验 · GitHub Advisory

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

CVE-2026-88018

### Summary `rclone serve s3`'s handler chain, when `--auth-proxy` is configured, is (outermost first): `authPairMiddlew

历史摘要 · 未重新核验 · GitHub Advisory

rclone: RC per-server auth-proxy bypass

CVE-2026-88044

## Summary `serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse t

历史摘要 · 未重新核验 · GitHub Advisory

rclone: FTP cross-session auth-proxy backend confusion

CVE-2026-88017

## Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind t

历史摘要 · 未重新核验 · GitHub Advisory

rclone: source object names can escape the configured root on upload

CVE-2026-88046

### Summary Multiple backends, when given a specially crafted object to copy, can escape the backend confinement. | Ba

历史摘要 · 未重新核验 · GitHub Advisory

rclone: S3 multipart declared-length memory exhaustion

CVE-2026-88045

## Summary In streamed multipart mode, `serve s3` passes the request's declared part length to `multipart.NewRW().Reser

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

CVE-2026-87011

## Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it w

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

CVE-2026-87012

# Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value ## Summary Calendar

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

CVE-2026-87013

## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. T

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

CVE-2026-87014

## Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every us

历史摘要 · 未重新核验 · GitHub Advisory

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

CVE-2026-59965

## Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission ### Summary `@jhb.software/p

历史摘要 · 未重新核验 · GitHub Advisory

@argos-ci/core: CI Branch Name OS Command Injection

CVE-2026-59960

## CI Branch Name OS Command Injection in @argos-ci/core ### Summary `@argos-ci/core@6.2.0` passes attacker-controlled

历史摘要 · 未重新核验 · GitHub Advisory

mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

## Unbounded Remote Media Fetch and Video Frame Expansion DoS ### Summary The `POST /v1/chat/completions` endpoint in m

历史摘要 · 未重新核验 · GitHub Advisory

mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

### Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary l

历史摘要 · 未重新核验 · GitHub Advisory

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because...

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files

历史摘要 · 未重新核验 · GitHub Advisory

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper...

CVE-2026-9176

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

CVE-2026-87015

## Summary When more than one external tool server is reachable in the same request, a tool call to a server configured

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

CVE-2026-87016

## Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match i

历史摘要 · 未重新核验 · GitHub Advisory