EUVD-2026-106875

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

RHLW-2026-C7216DB110A73995 Lightwell Security Advisory: commons-net 3.7.2.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.2.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-D10068B21671906A Lightwell Security Advisory: commons-net 3.8.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.8.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-71F0BC56442456D3 Lightwell Security Advisory: commons-net 3.7.1.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.1.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-E16A7A7E33D1BD95 Lightwell Security Advisory: commons-net 3.6.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.6.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-20F36034F30C7A24 Lightwell Security Advisory: commons-net 3.5.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.5.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-94B9703160382A25 Lightwell Security Advisory: commons-net 3.4.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.4.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-CE8CAF53627ADA47 Lightwell Security Advisory: commons-net 3.2.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.2.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-B6AD3B6E26EC332F Lightwell Security Advisory: commons-net 3.3.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.3.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-93C3DAF552B9D6BC Lightwell Security Advisory: commons-net 2.0.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 2.0.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777970333)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777970333 advisory. - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

CVE-2026-102722

The FTP Client is vulnerable to a flaw in the IPv4 PASV path where it accepts any address provided in the server's 227 reply . Because validation only ensures the address parses correctly and contains non-zero values, a malicious server can specify an arbitrary address to redirect the client. No ...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

EUVD-2026-89187

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

CVE-2026-102722: Server-Side Request Forgery (SSRF)

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

PT-2026-102788

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In the IPv4 PASV path, the FTP Client accepts any address provided in the server's 227 reply. Because validation is limited to parsing and checking for non-zero...