R
Vendor security profile
rclone
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs31
Critical6
CISA KEV0
Public exploit23
Patch rate%55
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
2
0
1
3
14
11
0
CVE KEV
CVE severity distribution
31toplam CVE
Critical6 (19%)
High8 (26%)
Medium14 (45%)
Low3 (10%)
Patch and exploitation view
%55
Verified patch
%0
CISA KEV
%74
Public exploit
12Patch available
5Partial
0Workaround
0Vendor: no patch
14Unknown
Latest vulnerabilities
4.6
CVE-2026-93987
rclone serve docker Path Traversal via Volume Name
R
Patch status unknownEPSS %0
2.3
CVE-2026-93986
rclone before 1.75.1 Path Traversal via Directory Listing Names
R
Patch status unknownEPSS %0
5.3
CVE-2026-88046
rclone: source object names can escape the configured root on upload
R
Patch verifiedEPSS %0
7.5
CVE-2026-88045
rclone: S3 multipart declared-length memory exhaustion
R
Patch verifiedEPSS %1
9.1
CVE-2026-88044
rclone: RC per-server auth-proxy bypass
R
Patch verifiedEPSS %0
9.8
CVE-2026-88018
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
R
Patch verifiedEPSS %1
7.3
CVE-2026-88017
rclone: FTP cross-session auth-proxy backend confusion
R
Patch verifiedEPSS %0
7.1
CVE-2026-88016
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
R
Patch verifiedEPSS %0
5.3
CVE-2026-88015
rclone local: crafted Range request against a translated symlink panics (DoS)
R
Patch verifiedEPSS %0
6.3
CVE-2026-88014
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
R
Patch verifiedEPSS %0