https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T08:35:22.914278+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-28295 CVE-2026-28295 — Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses 2026-10-02T08:35:22.916747+00:00

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

 https://vulnerability.circl.lu/vuln/usn-8114-1 USN-8114-1 — gvfs vulnerabilities 2026-10-02T08:35:22.916853+00:00

Affected: Ubuntu:22.04:LTS: gvfs, Ubuntu:24.04:LTS: gvfs, Ubuntu:25.10: gvfs

It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A malicious remote server could possibly use this issue to help scan for open ports. (CVE-2026-28295)

It was discovered that the GVfs FTP backend incorrectly handled crafted file paths. A remote attacker could use this issue to terminate or inject arbitrary FTP commands, or possibly execute arbitrary code. (CVE-2026-28296)