never-ending loop via server response omission

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...

FTP wildcard write callback mixup

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

CVE-2026-92388

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

UBUNTU-CVE-2026-92387

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...

UBUNTU-CVE-2026-92388

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

CVE-2026-92387

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...

PT-2026-113750

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1 Description A failure during an FTP wildcard LIST operation prevents the restoration of the write callback, leaving it set to the internal listing parser and the write callback data pointing to the easy...

CVE-2016-15060: Buffer Copy without Checking Size of Input

A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used...

PT-2026-113752

Name of the Vulnerable Software and Affected Versions PCMan FTP Server versions prior to 2.0.8 Description A buffer overflow occurs in the PORT Command Handler component. This issue allows a remote attacker to cause a crash or potentially execute arbitrary code by manipulating an unknown function...

PT-2026-114420

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description An ftp:// transfer configured with CURLUSESSL NONE may reuse a pooled FTP control connection previously upgraded with STARTTLS and authenticated via a client certificate. Because the subsequent...

CVE-2026-110231

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when...

CVE-2026-110231 muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when...

EUVD-2026-99015

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when...

CVE-2026-110231 muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorizedkeys that, when...

CVE-2026-110231

Versions of muCommander through 1.6.2 are vulnerable to a path traversal vulnerability in the UnpackJob component. The root cause is a failure to properly normalize remote paths, allowing attackers to bypass ZipSlip checks during archive extraction. By crafting malicious TAR or ZIP entries (e.g.,...

CVE-2026-90141

A flaw was found in the Linux kernel's IP Virtual Server IPVS FTP helper. A remote attacker could exploit an integer overflow vulnerability in the ipvsftpgetaddrport function by sending a specially crafted FTP PASV/EPSV response. This could cause the FTP helper to configure data connections with...

CVE-2026-102074

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-102074

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

EUVD-2026-98407

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-102074

The FTP service in several APOGEE and TALON products is vulnerable to a stack-based buffer overflow (CWE-121) due to improper validation of user-controllable input length. Affected systems include APOGEE MBC (PPC) , APOGEE MEC (PPC) , APOGEE PXC Compact , APOGEE PXC Modular , TALON TC Compact , a...