CVE-2026-116192: rclone from 1.37
- Severity
- 8.2 (HIGH)
- Vendor
- RCLONE FROM
- Affected versions
- Before 1.74.2
- Fixed version
- 1.74.2
- Patch status
- Patched
- Published
- 2026-10-25T14:16:59.550
Why it matters
This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
Technical summary
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via –rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
View the official NVD record for CVE-2026-116192
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
774 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-115905 |
zip is a zip library for Rust that supports reading and writing simple ZIP files PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-115188 |
mautic/core
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-102649 |
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110720 |
Consul-k8s PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-107092 |
NexoPOS v6.2.4
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107656 |
FortiSandbox
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-65184 |
Avocent ACS8000
Reporter: 44488DAB-36DB-4358-99F9-BC116477F914
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-10757 |
There is a SQL injection vulnerability in Esri ArcGIS Server
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110475 |
CreditNirvana Collections Platform (CollectionWorkz)
Reporter: VDISCLOSE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116214 |
MacCMS v10 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116485 |
danmu api PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-59106 |
Cynap Pure (Next Gen), Cynap Bridge
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77055 |
black_debian_images PATCH
Reporter: CVD
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-93328 |
MCP Toolbox for Databases (googleapis/mcp-toolbox)
Reporter: F45CBF4E-4146-4068-B7E1-655FFC2C548C
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112346 |
OpenHands Software Agent SDK PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116508 |
A950RG
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-59107 |
Cynap Pro, Cynap Core Pro
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-116747 |
Kener 3.0.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115693 |
hackney PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111841 |
Aman FunnelKit Automations wp-marketing-automations
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82944 |
SOEM
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115189 |
execution of arbitrary code on the server with the privileges of the web server process
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-77059 |
boneIO Black PATCH
Reporter: CVD
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115748 |
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105608 |
HASHICORP PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112438 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112623 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112626 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112637 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112651 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112655 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112659 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112688 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-113947 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-64759 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-86929 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116818 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58400 |
llama.cpp
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116836 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116837 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116838 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108525 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-108529 |
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109584 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110474 |
Agentic AI Call Centre
Reporter: VDISCLOSE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110499 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111101 |
the HTTP/1.1 chunked body reader of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113436 |
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114213 |
the WebSocket fragment reassembly of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115269 |
the HTTP/2 request body reader of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-77052 |
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path PATCH
Reporter: CVD
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-77053 |
the first-run wizard, and every API route is restricted to an authenticated role PATCH
Reporter: CVD
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116543 |
Open5GS 1.3.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116588 |
dd-trace-py PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116591 |
compress provides various compression algorithms PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116738 |
VMime
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116748 |
Transmission 4.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116811 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116843 |
Mistral Vibe PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116231 |
Pugongying X5 Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116232 |
Pugongying X5 Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116219 |
Dolibarr ERP CRM PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-112345 |
TTLock
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-112343 |
Syncplify Server! PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-115924 |
Rembg is a tool to remove images background PATCH
Reporter: SECURITY-ADVISORIES
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116504 |
A950RG
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116506 |
A950RG
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116808 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-113345 |
Electronic delivery item Inspection Support System
Reporter: VULTURES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116233 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116234 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116235 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116237 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-115608 |
an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-115948 |
David Lingren Media LIbrary Assistant media-library-assistant
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-71456 |
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass PATCH
Reporter: PRODUCTSECURITY
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116505 |
A950RG
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116723 |
FLTK
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116724 |
FLTK
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116816 |
llama.cpp
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116116 |
GM8135S Camera
Reporter: CNA
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107894 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107895 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107896 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107897 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107898 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107899 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107900 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-65327 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-116819 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-70388 |
SOEM
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-116741 |
Speex (libspeex)
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-116825 |
YesWiki from 4.6.2 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111103 |
Product identification pending PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-115193 |
MAUTIC
Reporter: SECURITY
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-97200 |
hackney conn in benoitc hackney PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116539 |
Netty netty-tcnative PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116540 |
netty-tcnative 2.0.66.Final PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116541 |
Netty netty-tcnative PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116634 |
OmniRoute 3.8.50 PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.