43
CVEs
5
Critical
22
High
0
KEV
0
PoC
24
Unpatched C/H
23.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
22
MEDIUM
15
LOW
1
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53790 | Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the CVSS 4.0 base score of 9.2 reflects full confidentiality, integrity, and availability impact. | CRITICAL | 9.2 | 0.5% | 47 |
No patch
|
| CVE-2026-70460 | Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symlinks that are followed while resolving the --partial-dir or --backup-dir paths, redirecting writes to the module-root parent and beyond. Any rsync daemon exposing a writable module - or a read/write sync where a sender controls symlinks - is exposed, and the CWE-22 path-traversal primitive can be leveraged to overwrite configuration, cron, or authorized_keys files for follow-on code execution. Fixed in v3.5.0; reported by VulnCheck with no public exploit identified at time of analysis. | CRITICAL | 9.2 | 0.4% | 46 |
No patch
|
| CVE-2026-53791 | IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote attackers forge their source address by injecting a crafted PROXY protocol header, defeating hosts allow/deny restrictions. Reported by VulnCheck and fixed in the v3.5.0 major security release, the flaw applies to daemons that trust PROXY protocol headers yet accept direct client connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact once the IP allowlist is circumvented. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-70452 | Access control bypass in rsync daemon versions 3.1.0 through 3.4.4 lets remote unauthenticated attackers evade module-level 'hosts deny' restrictions by forcing DNS resolution to fail during hostname-based access checks, causing the daemon to skip the rule (fail-open) instead of denying. Reported by VulnCheck and fixed in rsync 3.5.0, it exposes file trees in modules that were meant to be IP/hostname-restricted; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-53793 | Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. No public exploit has been identified at time of analysis, but the fix is a coordinated advisory (GHSA-wj7w-vh23-mm44) shipped in the major 3.5.0 security release. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-70461 | Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact. | HIGH | 8.8 | 0.5% | 45 |
No patch
|
| CVE-2026-70456 | Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-70458 | Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-70464 | Connection slot exhaustion in rsync daemon versions 2.0.0 through 3.4.x allows unauthenticated remote attackers to deny service to legitimate clients by stalling the protocol handshake across two distinct vectors. Pre-module-selection stalls are unconditionally effective because the daemon applies no timeout in that phase; post-module-selection, attackers can trickle data just above the I/O timeout floor to hold slots indefinitely while never completing the handshake. No public exploit identified at time of analysis, though the attack is trivially scriptable and requires no authentication or prior access. | HIGH | 8.7 | 0.6% | 44 |
No patch
|
| CVE-2026-70453 | CPU exhaustion in rsync receivers before 3.5.0 allows a remote sender to cause denial of service by exploiting quadratic-time worst-case behavior in the hash_search() function (CWE-407). A malicious or compromised sender delivers a carefully crafted file list - requiring only a modest number of entries - to collapse hash lookup performance and sustain receiver CPU exhaustion for the duration of the sync session. No public exploit has been identified at time of analysis, but the unauthenticated network attack vector and rsync's ubiquitous deployment in backup and file-synchronization infrastructure make patch urgency high. | HIGH | 8.7 | 0.5% | 44 |
No patch
|
| CVE-2026-70455 | Denial of service in rsync's receiver process allows a remote, unauthenticated sender to exhaust thread and memory resources by specifying the --zt short alias for --compress-threads, directly bypassing daemon-side refuse options directives that match only against long option names. Affected versions span 3.4.2 through 3.4.x prior to 3.5.0; the bypass is most damaging to operators who explicitly configured refuse options to block --compress-threads, since they believed a mitigation was in place. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.7 accurately reflects low-complexity, unauthenticated network exploitation with high availability impact. | HIGH | 8.7 | 0.5% | 44 |
No patch
|
| CVE-2026-53783 | Directory escape in rsync's rrsync restricted shell wrapper before version 3.5.0 allows authenticated users to read and write files outside their enforced directory boundaries via two distinct paths. The first is a TOCTOU race condition that substitutes a symlink after path validation but before file transfer; the second is direct abuse of unrestricted rsync flags - --copy-unsafe-links, -D, and --log-file - that rrsync fails to sanitize, requiring no race timing at all. Scored 8.6 (High) under CVSS 4.0 with full confidentiality and integrity compromise of the vulnerable system, this is a genuine priority for any deployment using rrsync for SSH-based restricted file sharing; no public exploit has been identified at time of analysis. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-70463 | Authorization bypass in rsync 3.1.0 through 3.4.x allows authenticated users to circumvent module-level access controls when group-based deny rules are configured with space-containing group names. The auth users directive's comma-only parser silently discards deny rules for any @Group Name entry whose group name contains a space, granting unintended access to restricted rsync modules regardless of the administrator's intended group-based exclusions. The rsync project designated v3.5.0 a major security release to address this flaw; no CISA KEV listing or public exploit code has been identified at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-53803 | Symlink following in rsync before 3.5.0 enables local privilege escalation by allowing a low-privileged attacker to redirect ancillary file writes - such as log files, batch files, or daemon statistics - to arbitrary filesystem locations. Affected installations are those where rsync executes with elevated privileges, specifically setuid binaries or privileged daemon configurations, making the impact proportional to how widely such configurations are deployed. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.5 and the designation of v3.5.0 as a 'major security release' by the rsync maintainers signal this is treated as a high-severity finding. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2026-53784 | Path traversal in rsync daemon before 3.5.0 allows remote rsync clients to read and write files outside the configured module root. The root cause is the daemon calling chdir() to the module root at session start without resolving symlinks via realpath(), so if the module root path or any path component is a symlink, subsequent relative-path operations resolve against the symlink target instead of the intended directory. Exploitation requires two server-side conditions - use chroot disabled and a symlink anywhere in the module root path - but no special conditions on the attacker side beyond having rsync client access to the module. No public exploit code or CISA KEV listing is identified at time of analysis. | HIGH | 8.4 | 0.2% | 42 |
No patch
|