CVE-2026-119568High· 7.4▾ Twilightvsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's sour…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
vsftpd <= 3.0.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119567Low· 3.1vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
CVE-2026-89409Medium· 5.3Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
CVE-2026-66279High· 7.2Dis-connect vulnerability in Connect Stack
CVE-2026-112408High· 8.1Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CVE-2026-76894Low· 3.1CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
CVE-2026-102551High· 7.7Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling