34 results · Clear filters · Feed
-
High 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…
KEV Nov 9, 2026 -
Medium 4.2CVE-2026-35414 Public exploit
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list …
-
Low 3.6CVE-2025-61984 Public exploit
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted source…
-
Medium 5.9
Openssh: denial-of-service in openssh
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may k…
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
High 8.1
Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 6.5
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…
-
Critical 9.8
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…
-
Unscored —
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed …
-
Unscored —CVE-2021-41617 Public exploit
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalati…
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
Medium 6.8
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
High 7.3
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execut…
-
High 7.0CVE-2016-10010 Public exploit
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which…
-
High 7.5
The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of…
-
Unscored —
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password …
-
Medium 6.4
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users t…
-
Medium 6.5
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote ser…
-
High 8.1CVE-2015-5600 Public exploit
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processi…
-
Low 3.7
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.…
-
Unscored —
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distribut…
-
Unscored —CVE-2008-3234 Public exploit
sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain a…
-
Unscored —
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that g…
-
Unscored —
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and p…
-
Unscored —
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service…
-
Unscored —
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user …
-
Unscored —
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large n…
-
Unscored —CVE-2000-0992 Public exploit
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary fil…