{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vsftpd-through-3.0.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-119568"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-119568\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["vsftpd (through 3.0.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003evsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.\u003c/p\u003e\n","date_modified":"2026-10-30T13:41:58Z","date_published":"2026-10-30T13:29:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vsftpd-auth-bypass/","summary":"vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections.","title":"vsftpd: Authentication bypass in ssl_data_accept (CVE-2026-119568)","url":"https://feed.craftedsignal.io/briefs/2026-10-vsftpd-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Vsftpd (Through 3.0.5)","version":"https://jsonfeed.org/version/1.1"}