CVE-2026-53799

rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-72971

Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 26h1 Windows 11 26h1

CVE-2026-70348

Windows Management Services Denial of Service Vulnerability

Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 3 more

CVE-2026-59242

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2026-72857

Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Budibase

CVE-2026-53783

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-72794

siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-71964

CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cyberpanel Usmannasir

Products

Cyberpanel Cyberpanel

CVE-2026-70554

MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Max-3000 Maxsite

Products

Maxsite Cms Maxsite Cms

CVE-2026-70460

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-68772

ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zenml

Products

Zenml

CVE-2026-68771

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Comfy

Products

Comfyui

CVE-2026-67595

VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Webreinvent

Products

Vaahcms

CVE-2026-59703

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Repomix Yamadashy

Products

Repomix Repomix

CVE-2026-57859

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

E107

Products

E107

CVE-2026-53803

rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53801

rsync < 3.5.0 Symlink Race Condition Directory Traversal

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53800

rsync < 3.5.0 Symlink Race Condition via --remove-source-files

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53797

rsync < 3.5.0 Symlink Race Condition Information Disclosure

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53796

rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync