GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:21436-1

Vulnerability from csaf_opensuse - Published: 2026-07-22 20:54 - Updated: 2026-09-17 17:40
Summary
Security update for rclone
Severity
Critical
Notes
Title of the patch: Security update for rclone
Description of the patch: This update for rclone fixes the following issues: Changes in rclone: - Update to version 1.74.4 (boo#1267192): * Version v1.74.4 * gui: update embedded release to 1.1.10 * local: stop --links symlinks escaping the destination directory CVE-2026-54572 * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw * s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc * serve restic: fix --private-repos isolation bypass CVE-2026-59733 * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732 * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v * build: fix multiple CVEs by upgrading to go1.26.5 * s3: fix mounting a prefix failing with 403 when HEAD is not permitted * drive, googlephotos: warn when using rclone's shared client_id #9580 * drive: fix stray %!(EXTRA) in unexportable google document log message * serve/http: fix --disable-zip so it works over rc * serve webdav: fix MOVE overwrite failing without Overwrite header * fs: fix negative offset when a suffix Range request exceeds object size * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers * cmd/mount2: fix NFS file creation by implementing Mknod * smb: fix for IBM iSeries and signature verification * mega: fix hard deleted files reappearing in listings - fixes #9554 * mega: wait for server events after upload, delete and move * vfs: fix hang reopening a file during the handle-caching grace period * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391 * fs: fix command line flag being ignored when set to its default value * docs: fix copy to clipboard functionality for code blocks * fs/operations: correct DeleteFile --backup-dir documentation * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities * docs: clarify copyto command description - Fixes #9527 * docs: fix typo in remote setup docs * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188 * * s3: fix error mapping in GetObject to match HeadObject * filter: fix --files-from copy stopping at the first unreadable file * docs: Fix RELEASE.md * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0 * completion: fix powershell completion corrupting non-ASCII names - fixes #9412 * docs/crypt: fix encrypted size example - Fixes #9202 * docs: drive: note Google verification exemption for personal use apps * rc: document that rc API access is equivalent to shell access * docs: drive: update documentation about "Computers" folder * accounting: fix goroutine leak in ResetCounters * docs: fix --windows-event-log-level help * backend/filelu: fix recursive listing path handling and file filtering * docs: bisync - clarify flag interaction and minor changes * docs: Update RELEASE.md to use cherry-pick -x * webdav: fix mixed property statuses in multi-status responses * s3: remove session token on cross-host redirects * drive: warn when non-exportable Google documents are skipped - #9475 * Start v1.74.4-DEV development - update x/image to 0.43 (bsc#1271056) - Update to version 1.74.3: (boo#1267869) - Bug Fixes - rc - Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood) - Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood) - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood) - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping - CVE-2026-27145: crypto/x509: split candidate hostname only once - log: Fix wrong source file:line in JSON logs from release builds (Nick Craig-Wood) - mount2: Fix empty directory listings on re-read (Janne Beate Bakeng) - serve s3: Fix multipart ListParts pagination returning wrong part numbers (Nick Craig-Wood) - serve sftp - Fix file corruption when a client resumes an upload (Nick Craig-Wood) - Fix truncate request being silently ignored (Nick Craig-Wood) - Local - Fix getXattr returning empty map instead of nil (Leon Brocard) - Drime - Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood) - Fix files being uploaded to the wrong directory (Nick Craig-Wood) - Remove duplicate upload_cutoff config option (Nick Craig-Wood) - Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood) - Drive - Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood) - Iclouddrive - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till) - Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood) - Update to version 1.74.2: (boo#1266210) - Bug Fixes - build - Update golang.org/x/net to v0.55.0 to address: - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content - CVE-2026-25680: html: denial of service when parsing arbitrary HTML - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes - CVE-2026-27136: html: duplicate attributes can cause XSS - Update golang.org/x/crypto to v0.52.0 to address: - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic - CVE-2026-39828: ssh: bypass of certificate restrictions - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate - CVE-2026-39833: ssh/agent: key constraints not enforced - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction - CVE-2026-39834: ssh: infinite loop on large channel writes - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement - update golang.org/x/image to v0.41.0 to address: - CVE-2026-42500: bmp: panic when reading out of bound palette index - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression - Update golang.org/x/sys to version v0.45.0 to address: - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740 - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash) - gui: Update embedded release to 1.1.8 (Nick Craig-Wood) - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood) - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood) - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H) - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood) - Drime - Fix file doesn't exists error when trying to delete (John Volk) - Fix 500 errors when listing shared folders (Alvinwylim) - Jottacloud - Support whitelabel service Phonero Sky (Tore Anderson) - Protondrive - Fix corrupted on transfer: sha1 hashes differ (William Tange) - S3 - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood) - WebDAV - Honour auth_redirect on listAll PROPFIND (Sai Asish Y) - Update to version 1.74.1: * Version v1.74.1 * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 * build: fix multiple CVEs by upgrading to go1.26.3 * drime: fix uploads of 100..200M files * drime: fix large file uploads landing in drive root instead of configured folder * docs: sponsor updates * s3: add new Fastly Object Storage regions * cloudinary: fix retrying every error and fix pacer sleep units * s3: fix STS call per request by caching AssumeRole credentials * protondrive: fix segfault when copying files missing revision metadata * protondrive: route library logging through rclone's logger * protondrive: route HTTP through rclone's transport * bisync: fix retryable without --resync error message when --resync has a critical failure * cmd/serve/s3: return object listings in key order * Start v1.74.1-DEV development - Update to version 1.74.0: * Version v1.74.0 * docs: add missing Huawei Drive docs * Add Huawei Drive support * s3: add Impossible Cloud as a new S3 provider * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI * gui: embed compressed dist.zip in the binary for smaller, reproducible builds * docs: update the GUI docs to reflect the new `rclone gui` * Add John Volk to contributors * drime: fix listings of large directories * docs: fix iCloud docs after website update (missed in the merge) * protondrive: fix server-side moveto and DirMove against current API * build: Update all packages with pseudo versions which aren't v0.0.0 * Add Chris Coughlan to contributors * Add Yakov Till to contributors * iclouddrive: add read only iCloud Photos support and SRP authentication * mountlib: rc: fix mounts created with mountPoint "*" overwriting each other * vfs/vfscache/downloaders: kick waiters periodically, not just once * rc: add user directories to core/disks and filter mounts better * docs: notes on how to update pseudo versions * Add dlaumen to contributors * Add Luke Cyca to contributors * Add mathieulongtin to contributors * protondrive: update to latest go-proton-api to use new host * docs: amend Google Drive client_id instructions to include running web-based auth flow * azureblob,azurefile: fix documentation about federated identity * internxt: implement multi-part uploads * serve dlna: remove file extensions from titles to prevent Samsung TV duplication * serve dlna: fix XML quote escaping for Samsung TV compatibility * serve dlna: handle empty ObjectID from Samsung TVs * serve dlna: add Samsung-specific XML namespace * serve dlna: fix invalid dc:date for containers * serve dlna: fix container childCount to reflect actual contents * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility * Add Anton Bordwine to contributors * listremotes: add --exact flag for filtering - fixes #9076 * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952 * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367 * Add tdawe to contributors * Add Jan Heylen to contributors * protondrive: align backend with newer Proton SDK stack * s3: fix bucket creation failing on Ceph/radosgw * rc: add core/disks to enumerate attached disks * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813 * Add SyoBoN to contributors * docs: fix typo * docs: fix code comment regarding cmount tag * s3: add HCP provider and list_versions_oldest_first quirk * mega: fix crash when logging in with previous auth keys fails * pcloud: fix recursive listing from the root - fixes #9315 * rc: flip auth default so all endpoints require auth unless opted out * Changelog updates from Version v1.73.5 * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179 * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176 * accounting: fix rcat/copyurl for files.com * bisync: fix integration tests after sftp log changes * build: bump actions/github-script from 8 to 9 * fstest/test_all: stop test servers on signal, panic, or exit * fstest/testserver: add CleanupAll for end-of-run server sweep * fstest/testserver: add force-stop and reconcile stale refcounts * fshttp: add --dump curl for dumping HTTP requests as curl commands * s3: fix empty delimiter parameter rejected by Archiware P5 server * serve nfs: fix EOF flag in READ response not being set when read reaches end of file * webdav: optimize performance by using Depth=0 for metadata requests * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy * azureblob: add --azureblob-decompress flag to download gzip-encoded files * docs: serve backend metadata as JSON on the website * azureblob/auth: add Microsoft Partner Network User-Agent prefix * vfs: add context parameter to New() for config propagation * vfs: replace context.TODO/Background with stored VFS context * build: fix `make fetch-gui` in CI workflow - it was in the wrong place * gui: join Wait goroutines on shutdown * gui: remove flag.Lookup test guard around browser open * gui: drop freePort helper, use libhttp port binding for the RC server * gui: allow serving from a local zip file or an unpacked directory * gui: don't run fetch-gui on make * build: fix GitHub API rate limit errors when fetching GUI dist in CI * drime: fix User.EntryPermissions JSON unmarshalling * filen: make multi-threaded upload chunks individually retryable * chore: add Enduriel as filen backend maintainer * filter: fix debug logs that fire before logger is configured - fixes #9291 * Add Mozi to contributors * Add Brais Couce to contributors * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI * s3: fix TencentCOS CDN endpoint failing on bucket check * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails * iclouddrive: fix 'directory not found' error when the directory contains accent marks * downloaders: fix flaky TestDownloaders/EnsureDownloader test * sftp: warn the user if no host key validation is configured * Add TheBabu to contributors * lib/http: Add HTTP/2 cleartext support in server configuration * build: add explicit permissions to GitHub Actions workflows * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file * webdav: Add a section on symlink/junction points in the help * Changelog updates from Version v1.73.4 * build: update all dependencies * docs: fix XSS vulnerability in dropdown mobile header * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder * linkbox: fix downloading files by using web API - fixes #8665 * vfs: fix tests after --vfs-handle-caching * Add Suyun to contributors * build: fix loong64 and s390x build * jottacloud: add encoding of percent character to default backend encoding * docs: fix markdown issues in mount docs * docs: fix header level for metadata option * vfs: fix slow nfs serve by adding --vfs-handle-caching * Add Xiangzhe to contributors * Add Mike GIllan to contributors * fix(docs): Fix link to not be language specific * iclouddrive: lowercase Apple ID for SRP authentication * iclouddrive: use dynamic origin for SRP auth headers * iclouddrive: replace plaintext signin with SRP authentication * docs: modernize rclone.org site design * Add Andriy Senyshyn to contributors * Add Claude Opus 4.6 to contributors * Add jinyu.han to contributors * Add jinkeyuu to contributors * Add lif to contributors * Add BizaNator to contributors * Add Patrick Farrell to contributors * Add Jason to contributors * Add ZRHan to contributors * Add Andrew Furman to contributors * Add Andriy Senyshyn to contributors * Add Bhagyashreek8 to contributors * s3: add UCloud Object Storage provider (#9230) * bisync: fix handling of unreadable lockfiles - fixes #9290 * librclone/ctest: add Windows support and fix memory management * s3: fix regression where PutObject fails with non-seekable readers * filen: update SDK version * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0 * docs: note macOS 10.15 (Catalina) support with version v1.70.3 * Add OVHcloud storage classes * local: remove fadvise calls that cause spinlock contention * Changelog updates from Version v1.73.3 * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 * docs/jottacloud: fix broken link * docs: clarify Filen password change requires updating both password and API key in rclone config * docs: note that Filen API key changes on password change * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 * webdav: request only required properties in listAll to improve performance * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk * s3: add multi tenant support for Cubbit * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching * copyurl: fix ignored --upload-headers and --download-headers * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth * list: fix nil pointer panic in Sorter when temp file creation fails * docs: update RELEASE procedure to avoid mistakes * Add Billy Hughes to contributors * accounting: Add deletedDirs stat to core/stats help output * docs: added text to the label showing version-introduced info * Changelog updates from Version v1.73.2 * fs/log: fix data race on OutputHandler.format field * build(deps): bump docker/build-push-action from 6 to 7 * build(deps): bump docker/setup-buildx-action from 3 to 4 * build(deps): bump docker/metadata-action from 5 to 6 * build(deps): bump docker/setup-qemu-action from 3 to 4 * build(deps): bump docker/login-action from 3 to 4 * bisync: update changelog * bisync: auto-generate rc help docs * bisync: add more structured info to rc output * bisync: add missing rc params - fixes #7799 * operations: multithread copy: grab memory before making go routines * b2: add server side copy real time accounting * s3: add server side copy real time accounting * azureblob: add server side copy real time accounting * operations: add method to real time account server side copy * Add Duncan F to contributors * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency * Add razorloves to contributors * docs: fix new drive flag typo in changelog * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220 * Add Bjoern Franke to contributors * Add Brian Bockelman to contributors * Add Romāns Potašovs to contributors * Add Adam Kasztenny to contributors * Add hxnd to contributors * Add Bjoern Franke to contributors * Add FTCHD to contributors * build(deps): bump actions/upload-artifact from 6 to 7 * build(deps): bump actions/download-artifact from 7 to 8 * serve http: add gzip compression * webdav: permit redirects on PROPFIND for metadata * webdav: add missing headers for CORS * docs: Document unsupported S3 object keys with double slashes * touch: add metadata when using `--metadata-set` * s3: ionos: updated regions & endpoints * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR * drive: add integration test for handling folder names with single quotes * http: dark mode for browser * docs: note that --use-server-modtime only works on some backends * Add a1pcm to contributors * Add Leon Brocard to contributors * Add Dark Dragon to contributors * internxt: fix Entry doesn't belong in directory errors on windows * drime: fix chunk-uploaded files ignoring workspace ID * s3: add new Fastly Object Storage regions * docs: Fix headers hierarchy for mount.md * serve http: add fallback embedded favicon * graphics: optimise images losslessly with ImageOptim * docs: update sponsors * Add Jan-Philipp Reßler to contributors * Add Chris to contributors * Add Shlomi Avihou to contributors * Add Jan-Philipp Reßler to contributors * Add Varun Chawla to contributors * Add Prakhar Chhalotre to contributors * s3: add Object Lock support * webdav: escape reserved characters in URL path segments * s3: add Zadara Object Storage provider * bisync: add group Sync to the bisync command * archive: extract: strip "./" prefix from tar entry paths * accounting: update String method output format for clarity in transfer rate representation - fixes #9129 * docs: add instructions on how to update Go version * build: modernize Go code with go fix for go1.25 * build: update all dependencies * lib/rest: remove go1.24 workaround now go1.25 is the minimum * build: update to go1.26 and make go1.25 the minimum required version * Add Jack Kelly to contributors * Changelog updates from Version v1.73.1 * build: fix build using go 1.26.0 instead of go 1.25.7 * fs/march: fix runtime: program exceeds 10000-thread limit * accounting: fix missing server side stats from core/stats rc * pacer: re-read the sleep time as it may be stale * pacer: fix deadlock between pacer token and --max-connections * test_all: increase retries for Internxt eventual consistency * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167 * drime: fix files and directories being created in the default workspace * docs: update sponsors * Add kingston125 to contributors * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path. * filelu: migrate API calls to lib/rest * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174 * docs: add ExchangeRate-API as a sponsor * Add Cohinem to contributors * Add Leon Brocard to contributors * s3: remove StackPath Object Storage provider * drime: implement About * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316 * Set list_version to 2 for FileLu S3 configuration * filelu: add multipart upload support with configurable cutoff * filelu: add multipart init response type * filelu: add comment for response body wrapping * filelu: avoid buffering entire file in memory * docs: update sponsor logos * s3: add Fastly Object Storage provider * filen: fix potential panic in case of error during upload * filen: fix 32 bit targets not being able to list directories Fixes #9142 * pikpak: support custom filenames for addurl backend command - fixes #9111 * Start v1.74.0-DEV development
Patchnames: openSUSE-Leap-16.0-packagehub-439
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-68121
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-25680
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-25681
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-27136
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-27141
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-27145
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-32952
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-33809
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-33813
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-33814
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39821
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39824
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact low
CVE-2026-39827
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39828
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39829
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39830
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39831
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39832
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39833
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39834
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-39835
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-41176
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact critical
CVE-2026-41179
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact critical
CVE-2026-42500
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-42502
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-42504
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-42506
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-42507
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-42508
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-44740
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-46595
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-46597
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-46598
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-49980
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact critical
CVE-2026-54572
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
CVE-2026-59732
5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact moderate
CVE-2026-59733
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 5 products, the same list as for CVE-2025-68121
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1262438 self
https://bugzilla.suse.com/1262439 self
https://bugzilla.suse.com/1266210 self
https://bugzilla.suse.com/1267192 self
https://bugzilla.suse.com/1267869 self
https://bugzilla.suse.com/1271056 self
https://www.suse.com/security/cve/CVE-2025-68121/ self
https://www.suse.com/security/cve/CVE-2026-25680/ self
https://www.suse.com/security/cve/CVE-2026-25681/ self
https://www.suse.com/security/cve/CVE-2026-27136/ self
https://www.suse.com/security/cve/CVE-2026-27141/ self
https://www.suse.com/security/cve/CVE-2026-27145/ self
https://www.suse.com/security/cve/CVE-2026-32952/ self
https://www.suse.com/security/cve/CVE-2026-33809/ self
https://www.suse.com/security/cve/CVE-2026-33813/ self
https://www.suse.com/security/cve/CVE-2026-33814/ self
https://www.suse.com/security/cve/CVE-2026-39821/ self
https://www.suse.com/security/cve/CVE-2026-39824/ self
https://www.suse.com/security/cve/CVE-2026-39827/ self
https://www.suse.com/security/cve/CVE-2026-39828/ self
https://www.suse.com/security/cve/CVE-2026-39829/ self
https://www.suse.com/security/cve/CVE-2026-39830/ self
https://www.suse.com/security/cve/CVE-2026-39831/ self
https://www.suse.com/security/cve/CVE-2026-39832/ self
https://www.suse.com/security/cve/CVE-2026-39833/ self
https://www.suse.com/security/cve/CVE-2026-39834/ self
https://www.suse.com/security/cve/CVE-2026-39835/ self
https://www.suse.com/security/cve/CVE-2026-41176/ self
https://www.suse.com/security/cve/CVE-2026-41179/ self
https://www.suse.com/security/cve/CVE-2026-42500/ self
https://www.suse.com/security/cve/CVE-2026-42502/ self
https://www.suse.com/security/cve/CVE-2026-42504/ self
https://www.suse.com/security/cve/CVE-2026-42506/ self
https://www.suse.com/security/cve/CVE-2026-42507/ self
https://www.suse.com/security/cve/CVE-2026-42508/ self
https://www.suse.com/security/cve/CVE-2026-44740/ self
https://www.suse.com/security/cve/CVE-2026-46595/ self
https://www.suse.com/security/cve/CVE-2026-46597/ self
https://www.suse.com/security/cve/CVE-2026-46598/ self
https://www.suse.com/security/cve/CVE-2026-49980/ self
https://www.suse.com/security/cve/CVE-2026-54572/ self
https://www.suse.com/security/cve/CVE-2026-59732/ self
https://www.suse.com/security/cve/CVE-2026-59733/ self
https://www.suse.com/security/cve/CVE-2025-68121 external
https://bugzilla.suse.com/1256818 external
https://bugzilla.suse.com/1268881 external
https://www.suse.com/security/cve/CVE-2026-25680 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-25681 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-27136 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-27141 external
https://bugzilla.suse.com/1259062 external
https://bugzilla.suse.com/1268677 external
https://www.suse.com/security/cve/CVE-2026-27145 external
https://bugzilla.suse.com/1267450 external
https://www.suse.com/security/cve/CVE-2026-32952 external
https://www.suse.com/security/cve/CVE-2026-33809 external
https://bugzilla.suse.com/1260692 external
https://www.suse.com/security/cve/CVE-2026-33813 external
https://www.suse.com/security/cve/CVE-2026-33814 external
https://bugzilla.suse.com/1264506 external
https://bugzilla.suse.com/1268758 external
https://www.suse.com/security/cve/CVE-2026-39821 external
https://bugzilla.suse.com/1266474 external
https://www.suse.com/security/cve/CVE-2026-39824 external
https://www.suse.com/security/cve/CVE-2026-39827 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39828 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39829 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39830 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39831 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39832 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39833 external
https://bugzilla.suse.com/1266049 external
https://bugzilla.suse.com/1272292 external
https://www.suse.com/security/cve/CVE-2026-39834 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-39835 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-41176 external
https://bugzilla.suse.com/1262438 external
https://www.suse.com/security/cve/CVE-2026-41179 external
https://bugzilla.suse.com/1262439 external
https://www.suse.com/security/cve/CVE-2026-42500 external
https://www.suse.com/security/cve/CVE-2026-42502 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-42504 external
https://bugzilla.suse.com/1267442 external
https://www.suse.com/security/cve/CVE-2026-42506 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-42507 external
https://bugzilla.suse.com/1267444 external
https://www.suse.com/security/cve/CVE-2026-42508 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-44740 external
https://bugzilla.suse.com/1267264 external
https://www.suse.com/security/cve/CVE-2026-46595 external
https://bugzilla.suse.com/1266049 external
https://bugzilla.suse.com/1278446 external
https://www.suse.com/security/cve/CVE-2026-46597 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-46598 external
https://bugzilla.suse.com/1266049 external
https://www.suse.com/security/cve/CVE-2026-49980 external
https://bugzilla.suse.com/1267869 external
https://www.suse.com/security/cve/CVE-2026-54572 external
https://bugzilla.suse.com/1271452 external
https://www.suse.com/security/cve/CVE-2026-59732 external
https://bugzilla.suse.com/1271454 external
https://www.suse.com/security/cve/CVE-2026-59733 external
https://bugzilla.suse.com/1271457 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rclone",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.74.4 (boo#1267192):\n  * Version v1.74.4\n  * gui: update embedded release to 1.1.10\n  * local: stop --links symlinks escaping the destination directory CVE-2026-54572\n  * local: don\u0027t restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw\n  * s3: strip STS security token on same-host HTTPS-\u003eHTTP redirect GHSA-cf44-9pgv-m4xc\n  * serve restic: fix --private-repos isolation bypass CVE-2026-59733\n  * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732\n  * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v\n  * build: fix multiple CVEs by upgrading to go1.26.5\n  * s3: fix mounting a prefix failing with 403 when HEAD is not permitted\n  * drive, googlephotos: warn when using rclone\u0027s shared client_id #9580\n  * drive: fix stray %!(EXTRA) in unexportable google document log message\n  * serve/http: fix --disable-zip so it works over rc\n  * serve webdav: fix MOVE overwrite failing without Overwrite header\n  * fs: fix negative offset when a suffix Range request exceeds object size\n  * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs\n  * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets\n  * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers\n  * cmd/mount2: fix NFS file creation by implementing Mknod\n  * smb: fix for IBM iSeries and signature verification\n  * mega: fix hard deleted files reappearing in listings - fixes #9554\n  * mega: wait for server events after upload, delete and move\n  * vfs: fix hang reopening a file during the handle-caching grace period\n  * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391\n  * fs: fix command line flag being ignored when set to its default value\n  * docs: fix copy to clipboard functionality for code blocks\n  * fs/operations: correct DeleteFile --backup-dir documentation\n  * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities\n  * docs: clarify copyto command description - Fixes #9527\n  * docs: fix typo in remote setup docs\n  * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188\n  * * s3: fix error mapping in GetObject to match HeadObject\n  * filter: fix --files-from copy stopping at the first unreadable file\n  * docs: Fix RELEASE.md\n  * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0\n  * completion: fix powershell completion corrupting non-ASCII names - fixes #9412\n  * docs/crypt: fix encrypted size example - Fixes #9202\n  * docs: drive: note Google verification exemption for personal use apps\n  * rc: document that rc API access is equivalent to shell access\n  * docs: drive: update documentation about \"Computers\" folder\n  * accounting: fix goroutine leak in ResetCounters\n  * docs: fix --windows-event-log-level help\n  * backend/filelu: fix recursive listing path handling and file filtering\n  * docs: bisync - clarify flag interaction and minor changes\n  * docs: Update RELEASE.md to use cherry-pick -x\n  * webdav: fix mixed property statuses in multi-status responses\n  * s3: remove session token on cross-host redirects\n  * drive: warn when non-exportable Google documents are skipped - #9475\n  * Start v1.74.4-DEV development\n\n- update x/image to 0.43 (bsc#1271056)\n\n- Update to version 1.74.3: (boo#1267869)\n  - Bug Fixes\n    - rc\n      - Fix unauthenticated command execution via --rc-serve inline\n        remotes CVE-2026-49980 (Nick Craig-Wood)\n      - Stop global.* connection string options changing config\n        CVE-2026-49980 (Nick Craig-Wood)\n    - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick\n      Craig-Wood)\n      - CVE-2026-42504: mime: quadratic complexity in\n        WordDecoder.DecodeHeader\n      - CVE-2026-42507: net/textproto: arbitrary input are included\n        in errors without any escaping\n      - CVE-2026-27145: crypto/x509: split candidate hostname only\n        once\n    - log: Fix wrong source file:line in JSON logs from release\n      builds (Nick Craig-Wood)\n    - mount2: Fix empty directory listings on re-read (Janne Beate\n      Bakeng)\n    - serve s3: Fix multipart ListParts pagination returning wrong\n      part numbers (Nick Craig-Wood)\n    - serve sftp\n      - Fix file corruption when a client resumes an upload (Nick\n        Craig-Wood)\n      - Fix truncate request being silently ignored (Nick\n        Craig-Wood)\n    - Local\n      - Fix getXattr returning empty map instead of nil (Leon\n        Brocard)\n  - Drime\n    - Fix server-side copy and move failing with Cloudflare 520\n      error (Nick Craig-Wood)\n    - Fix files being uploaded to the wrong directory (Nick\n      Craig-Wood)\n    - Remove duplicate upload_cutoff config option (Nick\n      Craig-Wood)\n    - Fix directory rename leaving the renamed folder empty in VFS\n      (Nick Craig-Wood)\n  - Drive\n    - Fix server-side move failing on shared drives with duplicate\n      dirs (Nick Craig-Wood)\n  - Iclouddrive\n    - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)\n    - Fix \"Index has invalid data\" error listing iCloud Photos\n      (Nick Craig-Wood)\n\n- Update to version 1.74.2: (boo#1266210)\n  - Bug Fixes\n    - build\n      - Update golang.org/x/net to v0.55.0 to address:\n        - CVE-2026-42506: html: incorrect handling of namespaced\n          elements in foreign content\n        - CVE-2026-39821: idna: failure to reject ASCII-only\n          Punycode-encoded labels\n        - CVE-2026-42502: html: incorrect handling of HTML elements\n          in foreign content\n        - CVE-2026-25680: html: denial of service when parsing\n          arbitrary HTML\n        - CVE-2026-25681: html: incorrect handling of character\n          references in DOCTYPE nodes\n        - CVE-2026-27136: html: duplicate attributes can cause XSS\n      - Update golang.org/x/crypto to v0.52.0 to address:\n        - CVE-2026-46598: ssh/agent: pathological inputs can lead\n          to client panic\n        - CVE-2026-46597: ssh: byte arithmetic causes underflow and\n          panic\n        - CVE-2026-39828: ssh: bypass of certificate restrictions\n        - CVE-2026-39835: ssh: server panic during\n          CheckHostKey/Authenticate\n        - CVE-2026-39833: ssh/agent: key constraints not enforced\n        - CVE-2026-39832: ssh/agent: agent constraints dropped when\n          forwarding keys\n        - CVE-2026-39827: ssh: memory leak when rejecting channels\n          can lead to DoS\n        - CVE-2026-39830: ssh: client can cause server deadlock on\n          unexpected responses\n        - CVE-2026-39829: ssh: pathological RSA/DSA parameters may\n          cause DoS\n        - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys\n          physical interaction\n        - CVE-2026-39834: ssh: infinite loop on large channel\n          writes\n        - CVE-2026-42508: ssh/knownhosts: auth bypass via\n          unenforced @revoked status\n        - CVE-2026-46595: ssh: VerifiedPublicKeyCallback\n          permissions skip enforcement\n      - update golang.org/x/image to v0.41.0 to address:\n        - CVE-2026-42500: bmp: panic when reading out of bound\n          palette index\n        - CVE-2026-33809: tiff: excessive resource consumption in\n          PackBits decompression\n      - Update golang.org/x/sys to version v0.45.0 to address:\n        - CVE-2026-39824: windows: integer overflow in\n          NewNTUnicodeString\n      - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix\n        CVE-2026-44740\n      - bisync: Fix --conflict-loser pathname with\n        --conflict-resolve newer (nielash)\n      - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)\n      - lib/http: Replace deprecated h2c.NewHandler with\n        http.Server.Protocols (Nick Craig-Wood)\n      - rc: Remove duplicate metrics_addr option registration (Nick\n        Craig-Wood)\n      - vfs/vfscache: Fix silent write failure when mounting with\n        remote:. (Lucky945H)\n    - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)\n  - Drime\n    - Fix file doesn\u0027t exists error when trying to delete (John\n      Volk)\n    - Fix 500 errors when listing shared folders (Alvinwylim)\n  - Jottacloud\n    - Support whitelabel service Phonero Sky (Tore Anderson)\n  - Protondrive\n    - Fix corrupted on transfer: sha1 hashes differ (William Tange)\n  - S3\n    - Add new MEGA S4 endpoints on megas4.com including\n      Asia-Pacific region (Nick Craig-Wood)\n  - WebDAV\n    - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)\n\n- Update to version 1.74.1:\n  * Version v1.74.1\n  * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814\n  * build: fix multiple CVEs by upgrading to go1.26.3\n  * drime: fix uploads of 100..200M files\n  * drime: fix large file uploads landing in drive root instead of configured folder\n  * docs: sponsor updates\n  * s3: add new Fastly Object Storage regions\n  * cloudinary: fix retrying every error and fix pacer sleep units\n  * s3: fix STS call per request by caching AssumeRole credentials\n  * protondrive: fix segfault when copying files missing revision metadata\n  * protondrive: route library logging through rclone\u0027s logger\n  * protondrive: route HTTP through rclone\u0027s transport\n  * bisync: fix retryable without --resync error message when --resync has a critical failure\n  * cmd/serve/s3: return object listings in key order\n  * Start v1.74.1-DEV development\n\n- Update to version 1.74.0:\n  * Version v1.74.0\n  * docs: add missing Huawei Drive docs\n  * Add Huawei Drive support\n  * s3: add Impossible Cloud as a new S3 provider\n  * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI\n  * gui: embed compressed dist.zip in the binary for smaller, reproducible builds\n  * docs: update the GUI docs to reflect the new `rclone gui`\n  * Add John Volk to contributors\n  * drime: fix listings of large directories\n  * docs: fix iCloud docs after website update (missed in the merge)\n  * protondrive: fix server-side moveto and DirMove against current API\n  * build: Update all packages with pseudo versions which aren\u0027t v0.0.0\n  * Add Chris Coughlan to contributors\n  * Add Yakov Till to contributors\n  * iclouddrive: add read only  iCloud Photos support and SRP authentication\n  * mountlib: rc: fix mounts created with mountPoint \"*\" overwriting each other\n  * vfs/vfscache/downloaders: kick waiters periodically, not just once\n  * rc: add user directories to core/disks and filter mounts better\n  * docs: notes on how to update pseudo versions\n  * Add dlaumen to contributors\n  * Add Luke Cyca to contributors\n  * Add mathieulongtin to contributors\n  * protondrive: update to latest go-proton-api to use new host\n  * docs: amend Google Drive client_id instructions to include running web-based auth flow\n  * azureblob,azurefile: fix documentation about federated identity\n  * internxt: implement multi-part uploads\n  * serve dlna: remove file extensions from titles to prevent Samsung TV duplication\n  * serve dlna: fix XML quote escaping for Samsung TV compatibility\n  * serve dlna: handle empty ObjectID from Samsung TVs\n  * serve dlna: add Samsung-specific XML namespace\n  * serve dlna: fix invalid dc:date for containers\n  * serve dlna: fix container childCount to reflect actual contents\n  * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility\n  * Add Anton Bordwine to contributors\n  * listremotes: add --exact flag for filtering - fixes #9076\n  * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952\n  * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367\n  * Add tdawe to contributors\n  * Add Jan Heylen to contributors\n  * protondrive: align backend with newer Proton SDK stack\n  * s3: fix bucket creation failing on Ceph/radosgw\n  * rc: add core/disks to enumerate attached disks\n  * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813\n  * Add SyoBoN to contributors\n  * docs: fix typo\n  * docs: fix code comment regarding cmount tag\n  * s3: add HCP provider and list_versions_oldest_first quirk\n  * mega: fix crash when logging in with previous auth keys fails\n  * pcloud: fix recursive listing from the root - fixes #9315\n  * rc: flip auth default so all endpoints require auth unless opted out\n  * Changelog updates from Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * accounting: fix rcat/copyurl for files.com\n  * bisync: fix integration tests after sftp log changes\n  * build: bump actions/github-script from 8 to 9\n  * fstest/test_all: stop test servers on signal, panic, or exit\n  * fstest/testserver: add CleanupAll for end-of-run server sweep\n  * fstest/testserver: add force-stop and reconcile stale refcounts\n  * fshttp: add --dump curl for dumping HTTP requests as curl commands\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * serve nfs: fix EOF flag in READ response not being set when read reaches end of file\n  * webdav: optimize performance by using Depth=0 for metadata requests\n  * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy\n  * azureblob: add --azureblob-decompress flag to download gzip-encoded files\n  * docs: serve backend metadata as JSON on the website\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * vfs: add context parameter to New() for config propagation\n  * vfs: replace context.TODO/Background with stored VFS context\n  * build: fix `make fetch-gui` in CI workflow - it was in the wrong place\n  * gui: join Wait goroutines on shutdown\n  * gui: remove flag.Lookup test guard around browser open\n  * gui: drop freePort helper, use libhttp port binding for the RC server\n  * gui: allow serving from a local zip file or an unpacked directory\n  * gui: don\u0027t run fetch-gui on make\n  * build: fix GitHub API rate limit errors when fetching GUI dist in CI\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filen: make multi-threaded upload chunks individually retryable\n  * chore: add Enduriel as filen backend maintainer\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * Add Mozi to contributors\n  * Add Brais Couce to contributors\n  * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails\n  * iclouddrive: fix \u0027directory not found\u0027 error when the directory contains accent marks\n  * downloaders: fix flaky TestDownloaders/EnsureDownloader test\n  * sftp: warn the user if no host key validation is configured\n  * Add TheBabu to contributors\n  * lib/http: Add HTTP/2 cleartext support in server configuration\n  * build: add explicit permissions to GitHub Actions workflows\n  * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file\n  * webdav: Add a section on symlink/junction points in the help\n  * Changelog updates from Version v1.73.4\n  * build: update all dependencies\n  * docs: fix XSS vulnerability in dropdown mobile header\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * linkbox: fix downloading files by using web API - fixes #8665\n  * vfs: fix tests after --vfs-handle-caching\n  * Add Suyun to contributors\n  * build: fix loong64 and s390x build\n  * jottacloud: add encoding of percent character to default backend encoding\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * vfs: fix slow nfs serve by adding --vfs-handle-caching\n  * Add Xiangzhe to contributors\n  * Add Mike GIllan to contributors\n  * fix(docs): Fix link to not be language specific\n  * iclouddrive: lowercase Apple ID for SRP authentication\n  * iclouddrive: use dynamic origin for SRP auth headers\n  * iclouddrive: replace plaintext signin with SRP authentication\n  * docs: modernize rclone.org site design\n  * Add Andriy Senyshyn to contributors\n  * Add Claude Opus 4.6 to contributors\n  * Add jinyu.han to contributors\n  * Add jinkeyuu to contributors\n  * Add lif to contributors\n  * Add BizaNator to contributors\n  * Add Patrick Farrell to contributors\n  * Add Jason to contributors\n  * Add ZRHan to contributors\n  * Add Andrew Furman to contributors\n  * Add Andriy Senyshyn to contributors\n  * Add Bhagyashreek8 to contributors\n  * s3: add UCloud Object Storage provider (#9230)\n  * bisync: fix handling of unreadable lockfiles - fixes #9290\n  * librclone/ctest: add Windows support and fix memory management\n  * s3: fix regression where PutObject fails with non-seekable readers\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Add OVHcloud storage classes\n  * local: remove fadvise calls that cause spinlock contention\n  * Changelog updates from Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * webdav: request only required properties in listAll to improve performance\n  * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * copyurl: fix ignored --upload-headers and --download-headers\n  * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * Add Billy Hughes to contributors\n  * accounting: Add deletedDirs stat to core/stats help output\n  * docs: added text to the label showing version-introduced info\n  * Changelog updates from Version v1.73.2\n  * fs/log: fix data race on OutputHandler.format field\n  * build(deps): bump docker/build-push-action from 6 to 7\n  * build(deps): bump docker/setup-buildx-action from 3 to 4\n  * build(deps): bump docker/metadata-action from 5 to 6\n  * build(deps): bump docker/setup-qemu-action from 3 to 4\n  * build(deps): bump docker/login-action from 3 to 4\n  * bisync: update changelog\n  * bisync: auto-generate rc help docs\n  * bisync: add more structured info to rc output\n  * bisync: add missing rc params - fixes #7799\n  * operations: multithread copy: grab memory before making go routines\n  * b2: add server side copy real time accounting\n  * s3: add server side copy real time accounting\n  * azureblob: add server side copy real time accounting\n  * operations: add method to real time account server side copy\n  * Add Duncan F to contributors\n  * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency\n  * Add razorloves to contributors\n  * docs: fix new drive flag typo in changelog\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * Add Bjoern Franke to contributors\n  * Add Brian Bockelman to contributors\n  * Add Rom\u0101ns Pota\u0161ovs to contributors\n  * Add Adam Kasztenny to contributors\n  * Add hxnd to contributors\n  * Add Bjoern Franke to contributors\n  * Add FTCHD to contributors\n  * build(deps): bump actions/upload-artifact from 6 to 7\n  * build(deps): bump actions/download-artifact from 7 to 8\n  * serve http: add gzip compression\n  * webdav: permit redirects on PROPFIND for metadata\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * touch: add metadata when using `--metadata-set`\n  * s3: ionos: updated regions \u0026 endpoints\n  * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR\n  * drive: add integration test for handling folder names with single quotes\n  * http: dark mode for browser\n  * docs: note that --use-server-modtime only works on some backends\n  * Add a1pcm to contributors\n  * Add Leon Brocard to contributors\n  * Add Dark Dragon to contributors\n  * internxt: fix Entry doesn\u0027t belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * s3: add new Fastly Object Storage regions\n  * docs: Fix headers hierarchy for mount.md\n  * serve http: add fallback embedded favicon\n  * graphics: optimise images losslessly with ImageOptim\n  * docs: update sponsors\n  * Add Jan-Philipp Re\u00dfler to contributors\n  * Add Chris to contributors\n  * Add Shlomi Avihou to contributors\n  * Add Jan-Philipp Re\u00dfler to contributors\n  * Add Varun Chawla to contributors\n  * Add Prakhar Chhalotre to contributors\n  * s3: add Object Lock support\n  * webdav: escape reserved characters in URL path segments\n  * s3: add Zadara Object Storage provider\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * accounting: update String method output format for clarity in transfer rate representation - fixes #9129\n  * docs: add instructions on how to update Go version\n  * build: modernize Go code with go fix for go1.25\n  * build: update all dependencies\n  * lib/rest: remove go1.24 workaround now go1.25 is the minimum\n  * build: update to go1.26 and make go1.25 the minimum required version\n  * Add Jack Kelly to contributors\n  * Changelog updates from Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * test_all: increase retries for Internxt eventual consistency\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * Add kingston125 to contributors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * filelu: migrate API calls to lib/rest\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * Add Cohinem to contributors\n  * Add Leon Brocard to contributors\n  * s3: remove StackPath Object Storage provider\n  * drime: implement About\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * s3: add Fastly Object Storage provider\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * pikpak: support custom filenames for addurl backend command - fixes #9111\n  * Start v1.74.0-DEV development\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-439",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21436-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262438",
        "url": "https://bugzilla.suse.com/1262438"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262439",
        "url": "https://bugzilla.suse.com/1262439"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266210",
        "url": "https://bugzilla.suse.com/1266210"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267192",
        "url": "https://bugzilla.suse.com/1267192"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267869",
        "url": "https://bugzilla.suse.com/1267869"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271056",
        "url": "https://bugzilla.suse.com/1271056"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-68121 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-68121/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25680 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25680/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27136 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27136/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27141 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27145 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27145/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32952 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32952/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33809 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33809/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33813 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33813/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39824 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39824/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39827 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39828 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39828/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39829 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39831/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39832 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39833 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39833/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39834 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39834/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39835 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39835/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41176 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41176/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41179 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41179/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42500 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42500/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42502 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42502/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42504 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42504/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42507 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42507/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42508 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42508/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-44740 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-44740/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46595 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46595/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46597 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46597/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46598 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46598/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-49980 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-49980/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54572 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54572/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59732 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59732/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59733 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59733/"
      }
    ],
    "title": "Security update for rclone",
    "tracking": {
      "current_release_date": "2026-09-17T17:40:09Z",
      "generator": {
        "date": "2026-07-22T20:54:49Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21436-1",
      "initial_release_date": "2026-07-22T20:54:49Z",
      "revision_history": [
        {
          "date": "2026-07-22T20:54:49Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-07-22T20:54:49Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:43:15Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:44:59Z",
          "number": "4",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:40:09Z",
          "number": "5",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-0:1.74.4-bp160.1.1.aarch64",
                "product": {
                  "name": "rclone-0:1.74.4-bp160.1.1.aarch64",
                  "product_id": "rclone-0:1.74.4-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:rclone:rclone:1.74.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/rclone@1.74.4-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
                "product": {
                  "name": "rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
                  "product_id": "rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rclone-bash-completion@1.74.4-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch",
                "product": {
                  "name": "rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch",
                  "product_id": "rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rclone-zsh-completion@1.74.4-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-0:1.74.4-bp160.1.1.ppc64le",
                "product": {
                  "name": "rclone-0:1.74.4-bp160.1.1.ppc64le",
                  "product_id": "rclone-0:1.74.4-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:rclone:rclone:1.74.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/rclone@1.74.4-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-0:1.74.4-bp160.1.1.x86_64",
                "product": {
                  "name": "rclone-0:1.74.4-bp160.1.1.x86_64",
                  "product_id": "rclone-0:1.74.4-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:rclone:rclone:1.74.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/rclone@1.74.4-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-0:1.74.4-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64"
        },
        "product_reference": "rclone-0:1.74.4-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-0:1.74.4-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le"
        },
        "product_reference": "rclone-0:1.74.4-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-0:1.74.4-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64"
        },
        "product_reference": "rclone-0:1.74.4-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-0:1.74.4-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch"
        },
        "product_reference": "rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        },
        "product_reference": "rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-68121",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-68121"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-68121",
          "url": "https://www.suse.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256818 for CVE-2025-68121",
          "url": "https://bugzilla.suse.com/1256818"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268881 for CVE-2025-68121",
          "url": "https://bugzilla.suse.com/1268881"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-68121"
    },
    {
      "cve": "CVE-2026-25680",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25680"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25680",
          "url": "https://www.suse.com/security/cve/CVE-2026-25680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25680",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25680"
    },
    {
      "cve": "CVE-2026-25681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25681",
          "url": "https://www.suse.com/security/cve/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25681",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25681"
    },
    {
      "cve": "CVE-2026-27136",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27136"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27136",
          "url": "https://www.suse.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-27136",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27136"
    },
    {
      "cve": "CVE-2026-27141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27141",
          "url": "https://www.suse.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259062 for CVE-2026-27141",
          "url": "https://bugzilla.suse.com/1259062"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268677 for CVE-2026-27141",
          "url": "https://bugzilla.suse.com/1268677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27141"
    },
    {
      "cve": "CVE-2026-27145",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27145"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname\u0027s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27145",
          "url": "https://www.suse.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267450 for CVE-2026-27145",
          "url": "https://bugzilla.suse.com/1267450"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27145"
    },
    {
      "cve": "CVE-2026-32952",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32952"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32952",
          "url": "https://www.suse.com/security/cve/CVE-2026-32952"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32952"
    },
    {
      "cve": "CVE-2026-33809",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33809"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33809",
          "url": "https://www.suse.com/security/cve/CVE-2026-33809"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260692 for CVE-2026-33809",
          "url": "https://bugzilla.suse.com/1260692"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33809"
    },
    {
      "cve": "CVE-2026-33813",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33813"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33813",
          "url": "https://www.suse.com/security/cve/CVE-2026-33813"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33813"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268758 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1268758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-39824",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39824"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39824",
          "url": "https://www.suse.com/security/cve/CVE-2026-39824"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-39824"
    },
    {
      "cve": "CVE-2026-39827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39827",
          "url": "https://www.suse.com/security/cve/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39827",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39827"
    },
    {
      "cve": "CVE-2026-39828",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39828"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39828",
          "url": "https://www.suse.com/security/cve/CVE-2026-39828"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39828",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39828"
    },
    {
      "cve": "CVE-2026-39829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39829",
          "url": "https://www.suse.com/security/cve/CVE-2026-39829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39829",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39829"
    },
    {
      "cve": "CVE-2026-39830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39830",
          "url": "https://www.suse.com/security/cve/CVE-2026-39830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39830",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39830"
    },
    {
      "cve": "CVE-2026-39831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39831",
          "url": "https://www.suse.com/security/cve/CVE-2026-39831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39831",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39831"
    },
    {
      "cve": "CVE-2026-39832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39832",
          "url": "https://www.suse.com/security/cve/CVE-2026-39832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39832",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39832"
    },
    {
      "cve": "CVE-2026-39833",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39833"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39833",
          "url": "https://www.suse.com/security/cve/CVE-2026-39833"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39833",
          "url": "https://bugzilla.suse.com/1266049"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272292 for CVE-2026-39833",
          "url": "https://bugzilla.suse.com/1272292"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39833"
    },
    {
      "cve": "CVE-2026-39834",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39834"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39834",
          "url": "https://www.suse.com/security/cve/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39834",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39834"
    },
    {
      "cve": "CVE-2026-39835",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39835"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39835",
          "url": "https://www.suse.com/security/cve/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39835",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39835"
    },
    {
      "cve": "CVE-2026-41176",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41176"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41176",
          "url": "https://www.suse.com/security/cve/CVE-2026-41176"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262438 for CVE-2026-41176",
          "url": "https://bugzilla.suse.com/1262438"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-41176"
    },
    {
      "cve": "CVE-2026-41179",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41179"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41179",
          "url": "https://www.suse.com/security/cve/CVE-2026-41179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262439 for CVE-2026-41179",
          "url": "https://bugzilla.suse.com/1262439"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-41179"
    },
    {
      "cve": "CVE-2026-42500",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42500"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42500",
          "url": "https://www.suse.com/security/cve/CVE-2026-42500"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-42500"
    },
    {
      "cve": "CVE-2026-42502",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42502"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42502",
          "url": "https://www.suse.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42502",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42502"
    },
    {
      "cve": "CVE-2026-42504",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42504"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42504",
          "url": "https://www.suse.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267442 for CVE-2026-42504",
          "url": "https://bugzilla.suse.com/1267442"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-42504"
    },
    {
      "cve": "CVE-2026-42506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42506",
          "url": "https://www.suse.com/security/cve/CVE-2026-42506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42506",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42506"
    },
    {
      "cve": "CVE-2026-42507",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42507"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42507",
          "url": "https://www.suse.com/security/cve/CVE-2026-42507"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267444 for CVE-2026-42507",
          "url": "https://bugzilla.suse.com/1267444"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-42507"
    },
    {
      "cve": "CVE-2026-42508",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42508"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42508",
          "url": "https://www.suse.com/security/cve/CVE-2026-42508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-42508",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42508"
    },
    {
      "cve": "CVE-2026-44740",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-44740"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-44740",
          "url": "https://www.suse.com/security/cve/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267264 for CVE-2026-44740",
          "url": "https://bugzilla.suse.com/1267264"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-44740"
    },
    {
      "cve": "CVE-2026-46595",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46595"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46595",
          "url": "https://www.suse.com/security/cve/CVE-2026-46595"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46595",
          "url": "https://bugzilla.suse.com/1266049"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-46595",
          "url": "https://bugzilla.suse.com/1278446"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46595"
    },
    {
      "cve": "CVE-2026-46597",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46597"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46597",
          "url": "https://www.suse.com/security/cve/CVE-2026-46597"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46597",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46597"
    },
    {
      "cve": "CVE-2026-46598",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46598"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46598",
          "url": "https://www.suse.com/security/cve/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46598",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46598"
    },
    {
      "cve": "CVE-2026-49980",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-49980"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-49980",
          "url": "https://www.suse.com/security/cve/CVE-2026-49980"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267869 for CVE-2026-49980",
          "url": "https://bugzilla.suse.com/1267869"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-49980"
    },
    {
      "cve": "CVE-2026-54572",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54572"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54572",
          "url": "https://www.suse.com/security/cve/CVE-2026-54572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271452 for CVE-2026-54572",
          "url": "https://bugzilla.suse.com/1271452"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54572"
    },
    {
      "cve": "CVE-2026-59732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59732",
          "url": "https://www.suse.com/security/cve/CVE-2026-59732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271454 for CVE-2026-59732",
          "url": "https://bugzilla.suse.com/1271454"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59732"
    },
    {
      "cve": "CVE-2026-59733",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59733"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user\u0027s private repository on backends that clean path components. This issue is fixed in version 1.74.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59733",
          "url": "https://www.suse.com/security/cve/CVE-2026-59733"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271457 for CVE-2026-59733",
          "url": "https://bugzilla.suse.com/1271457"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-0:1.74.4-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-0:1.74.4-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-0:1.74.4-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T20:54:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59733"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.