| Bug | bookworm | trixie | sid | Description |
|---|
| CVE-2026-116196 | vulnerable | vulnerable (no DSA) | fixed | Rclone before v1.75.2 contains a credential exposure vulnerability in ... |
| CVE-2026-116194 | vulnerable | vulnerable (no DSA) | fixed | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery ... |
| CVE-2026-116192 | vulnerable | vulnerable (no DSA) | fixed | rclone from 1.37 before 1.74.2 contains a server-side request forgery ... |
| CVE-2026-116191 | vulnerable | vulnerable (no DSA) | fixed | Rclone before 1.75.2 contains a path traversal vulnerability in serve ... |
| CVE-2026-116190 | vulnerable | vulnerable (no DSA) | fixed | rclone from v1.56.0 before v1.75.2 contains an information disclosure ... |
| CVE-2026-93987 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnera ... |
| CVE-2026-93986 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before 1.75.1 fails to confine names from server and third-part ... |
| CVE-2026-88046 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-88018 | fixed | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-88016 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-88015 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-88013 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-79783 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before 1.74.4 fails to mask special permission bits when applyi ... |
| CVE-2026-79782 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header wh ... |
| CVE-2026-79781 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone serve s3 before 1.74.4 contains a path traversal vulnerability ... |
| CVE-2026-79780 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE- ... |
| CVE-2026-79779 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone versions before v1.75.0 fail to reject transport downgrades in ... |
| CVE-2026-79778 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before v1.75.0 contains a denial of service vulnerability in th ... |
| CVE-2026-79777 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before v1.75.0 includes full Go stack traces in RC API error re ... |
| CVE-2026-79776 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone before 1.75.0 mounts the pprof debug handler as its own router ... |
| CVE-2026-79775 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain m ... |
| CVE-2026-71313 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-71312 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-71311 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-71310 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-71309 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-59733 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-59732 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-54572 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-49980 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-41179 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2026-41176 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |
| CVE-2024-52522 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Rclone is a command-line program to sync files and directories to and ... |