SUSE-SU-2026:4909-1 Security update for squid

This update for squid fixes the following issues: - CVE-2023-5824: Multiple issues in HTTP response caching bsc1216496. - CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature bsc1217825. - CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

PT-2026-123402

Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer...

Amazon Linux 2023 : ant, ant-antlr, ant-apache-bcel (ALAS2023-2026-3239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3239 advisory. The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the...

Important: ant

Issue Overview: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the...

Important: ant

Issue Overview: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the...

Amazon Linux 2 : ant (ALAS-2026-4020)

The version of ant installed on the remote host is prior to 1.9.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4020 advisory. The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow ...

Security Bulletin:Vulnerability in ant-1.10.15 may affect IBM Infosphere Change Data Capture (CVE-2026-78254)

Summary A security vulnerability has been identified in ant, Apache Ant. ant is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp...

CLEANSTART-2026-DD03194 ftp and scp tasks of Apache Ant can download files from a remote server

Security vulnerability affects the rundeck package. The ftp and scp tasks of Apache Ant can download files from a remote server...

Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free

The version of curl installed on the remote host is 7.21.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal...

Curl 8.10.0 < 8.23.0 Transfer Timeout Bypass DoS

The version of curl installed on the remote host is 8.10.0 prior to 8.23.0. It is, therefore, affected by a denial of service vulnerability: - By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

CVE-2026-82819

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberu...

CVE-2026-82819 Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberu...

EUVD-2026-107041

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberu...

CVE-2026-82819

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By providing a malicious SMB share path, an attacker can trigger authentication coercion against the underlying server, leading to the leakage of the Cerberus ...

EUVD-2026-106875

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...