Threats affecting pkg:bitnami/rclone

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

CoreShop by CoreUnion versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw arises from improper neutralization of special elements in the 'order' parameter used in an ORDER BY clause, allowing anonymous attackers to inject subqueries. Exploitation can lead to extraction of member accounts and orders via boolean-based or time-based blind SQL injection techniques.

CoreShop versions up to 1.5.5 have an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint. The flaw arises from improper validation of the 'order' parameter used in the ORDER BY clause, allowing attackers to inject subqueries. This can lead to extraction of sensitive data such as member accounts and orders using blind SQL injection techniques.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server versions up to 3.0.7 have an authorization bypass vulnerability in the FeedController.delFeed function. Authenticated users can delete moments belonging to other users by providing arbitrary feedId values in POST requests to /feed/del. This allows attackers to remove other users' moments, including associated media, comments, and likes.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Tencent BlueKing CMDB (bk-cmdb) versions up to 3.14.6 have a missing authorization vulnerability that allows authenticated users to access host information from other businesses. This occurs via the POST /api/v3/hosts/search/asstdetail endpoint, which improperly skips authorization checks, enabling unauthorized host data retrieval.

RuoYi-Vue-Plus versions up to 6.0.0 have an authorization bypass vulnerability in the SysUserServiceImpl.selectUserListByDept function. Authenticated users with the system:user:list permission under a department-restricted role can access user information from any department by specifying arbitrary department IDs. This allows them to retrieve usernames, nicknames, account status, last login IP and time, and remarks of users outside their authorized scope.

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

Blossom Editor versions up to 1.17.1 have an authorization bypass vulnerability allowing authenticated users with non-readonly privileges to manipulate other users' pictures by specifying arbitrary picture IDs. This flaw enables attackers to delete images or change their star status via specific endpoints.

CVE-2026-119680 is a stored cross-site scripting (XSS) vulnerability in ManageEngine SharePoint Manager Plus affecting the chart feature. It arises from improper sanitization and HTML encoding of user-controlled data such as users' full names, site names, or group names. Malicious HTML or JavaScript injected by an attacker is stored and executed in other users' browsers when viewing affected charts. The vulnerability has been fixed in client application build 4508.

Cisco has addressed a serious vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The vulnerability details, including affected versions and technical specifics, are not provided in the available information.

CVE-2026-100355 is a server-side request forgery (SSRF) vulnerability in the basecamp once-campfire web-based chat application versions 1.4.4 and earlier. The vulnerability arises because the server fetches URLs in messages to generate OpenGraph previews, but the IP address filtering mechanism does not cover certain special-use IP ranges. This allows an authenticated user to bypass restrictions and cause the server to make requests to internal network resources. The confidentiality impact is limited to the OpenGraph metadata returned, with no integrity or availability impact. The issue was fixed in version 1.4.5.

The Kirki plugin for WordPress versions prior to 6.2.5 has a vulnerability that allows unauthenticated attackers to bypass the reCAPTCHA verification on frontend forms. By omitting the g-recaptcha-token field in POST requests, attackers can submit forms without valid verification, leading to unlimited form submissions and triggering notification emails, webhooks, and database writes without completing reCAPTCHA validation. This issue is fixed in version 6.2.5.

This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.

Kirki plugin for WordPress versions before 6.4.1 has a broken object-level access control vulnerability in its REST API. This flaw allows users with the Editor role, who have Kirki edit access, to modify the title, slug, and publication status of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the plugin relies only on a coarse role-based check without verifying per-object WordPress capabilities. This can lead to unauthorized exposure or removal of content.