https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12084.htmlhttps://patchthecve.com/cve/CVE-2024-12084.htmlWed, 21 Oct 2026 17:17:23 +0000CRITICAL 9.8: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.https://patchthecve.com/cve/CVE-2024-12087.htmlhttps://patchthecve.com/cve/CVE-2024-12087.htmlWed, 21 Oct 2026 21:17:27 +0000MEDIUM 6.5: A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper syhttps://patchthecve.com/cve/CVE-2024-12086.htmlhttps://patchthecve.com/cve/CVE-2024-12086.htmlFri, 21 Aug 2026 13:16:23 +0000MEDIUM 6.1: A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with https://patchthecve.com/cve/CVE-2020-36770.htmlhttps://patchthecve.com/cve/CVE-2020-36770.htmlWed, 17 Jun 2026 03:16:11 +0000CRITICAL 9.8: pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files.https://patchthecve.com/cve/CVE-2016-20021.htmlhttps://patchthecve.com/cve/CVE-2016-20021.htmlWed, 17 Jun 2026 00:43:06 +0000CRITICAL 9.8: In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.