CVE-2026-63091 is a HIGH severity vulnerability in ProFTPD's mod_sftp module, which allows authenticated low-privilege attackers to bypass ASLR and potentially lead to memory corruption by exploiting a signed integer overflow in the SCP size-record parser. This occurs when an attacker sends a crafted file size value of UINT64_MAX, causing a negative off_t value that, when converted to uint32_t, results in [truncated]
CVE-2026-42167 is a remote code execution vulnerability in ProFTPD's mod_sql module. The vulnerability allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands. The affected product is ProFTPD versions before 1.3.9a. The vulnerability has a high severity and requires immediate at [truncated]
