Malicious code in @zalastax/nolb-pasv (npm)

The package @zalastax/nolb-pasv was found to contain malicious code. --- Credit: OpenSSF source...

JLSEC-2026-1284

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

PT-2026-80526

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

CLSA-2026-1786488345 wget: Fix of CVE-2026-15146

CVE-2026-15146: validate the address advertised in an FTP PASV/LPSV response against the control connection's peer, so a malicious FTP server cannot redirect the data connection to an arbitrary host SSRF...

SUSE-SU-2026:3530-1 Security update for python310

This update for python310 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-3276: quadratic complexity in unicodedata.normalize can le...

CLSA-2026-1786033005 Fix CVE(s): CVE-2026-15146

SECURITY UPDATE: SSRF via unvalidated FTP PASV/LPSV response address - debian/patches/CVE-2026-15146.patch: validate the PASV/LPSV response address against the control connection peer in src/ftp-basic.c - CVE-2026-15146...

SUSE-SU-2026:23163-1 Security update for wget

This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. - CVE-2026-58470:...

CLSA-2026-1784899129 Fix CVE(s): CVE-2026-15146

SECURITY UPDATE: SSRF via unvalidated FTP PASV/LPSV response address - debian/patches/CVE-2026-15146.patch: validate the PASV/LPSV response address against the control connection peer in src/ftp-basic.c - CVE-2026-15146...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:3205-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3205-1 advisory. This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side reques...

SUSE SLES15 Security Update : wget (SUSE-SU-2026:3206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3206-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. -...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

CLSA-2026-1784815431 Fix CVE(s): CVE-2026-15146

SECURITY UPDATE: SSRF via unvalidated FTP PASV/LPSV response address - debian/patches/CVE-2026-15146.patch: validate the PASV/LPSV response address against the control connection peer in src/ftp-basic.c - CVE-2026-15146...

SUSE SLED15 / SLES15 Security Update : wget (SUSE-SU-2026:3148-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3148-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery...

PT-2026-95656

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.6 Description The FTP parser in src/app-layer-ftp.c incorrectly handles RETR or STOR commands when they are sent before PORT or PASV negotiation. Instead of treating this as a recoverable protocol event, the syst...

SUSE CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port. This allows an...

DEBIAN-CVE-2026-15146

GNU Wget versions 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address...

CVE-2026-15146 CVE-2026-15146

GNU Wget versions 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address...

CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...

CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...

GNU Wget enables SSRF via unvalidated FTP PASV IPs

Overview GNU Wget, versions 1.25.0 and earlier, contains a server-side request forgery SSRF vulnerability in its implementation of FTP passive mode. Because Wget does not properly validate IP addresses obtained from PASV responses, an attacker-controlled FTP endpoint can redirect the client’s...