These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-67193 is an information disclosure vulnerability in Xlight FTP Server before version 3.9.5. The vulnerability allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix, triggering the admin protocol path within the standard FTP listener pre-authentication. This leaks timing information from the FTP 331 [truncated]
CVE-2026-67192 is a pre-authentication stack buffer overflow vulnerability in Xlight FTP Server before version 3.9.5. The vulnerability allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated, potentially leading to remote code execution. Defenders should assess exposure, prioritize remediation, and verify the authenticity of SSH packets.
A critical vulnerability exists in Xlight FTP Server versions before 3.9.5, allowing remote unauthenticated attackers to exploit a heap buffer overflow via a malformed SSH client identification string. This issue arises from a logic error in the recv loop's termination condition, which uses an incorrect OR operator where an AND operator is required. As a result, any SSH or SFTP connection can be exploited [truncated]