Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,255 results · page 3 of 26
Sep 15, 2026Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to exeCVE-2026-80217 · Other software · LITE-ON Technology Corporation · reported by vultures@jpcert.or.jpHigh 8.7
Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.
- Product
- FF-RFI079I4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into auCVE-2026-90767 · Other software · froxlor · reported by VulnCheckHigh 7.1
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session.CVE-2026-78550 · Other software · Okta · reported by psirt@okta.comMedium 6.6
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.
- Product
- Okta Access Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.CVE-2026-69397 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authenticaCVE-2026-67278 · Network & remote access · Mikrotik · reported by cvd@cert.plMedium 6.3
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus bCVE-2026-67276 · Network & remote access · Mikrotik · reported by cvd@cert.plCritical 9.2
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.CVE-2026-18858 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixCVE-2026-85394 · Other software · mpdavis · reported by VulnCheckCritical 9.3
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
- Product
- python-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Previously, a channel registered in the mux's chanList is not usable until it is established.CVE-2026-78662 · Other software · golang.org/x/crypto · reported by security@golang.orgHigh 7.5
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.CVE-2026-56855 · Other software · golang.org/x/crypto · reported by security@golang.orgHigh 7.5
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / CVE-2026-53611 · Other software · AS203038 · reported by GitHubCritical 9.8
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- Product
- looking-glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers.CVE-2026-84694 · Other software · coollabsio · reported by VulnCheckHigh 8.7
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administratiCVE-2026-76658 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
- Product
- Fabric Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCaCVE-2026-56854 · Other software · golang.org/x/crypto · reported by security@golang.orgHigh 7.5
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.CVE-2026-59297 · Other software · Spring · reported by security@vmware.comLow 3.1
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
- Product
- Spring Cloud Function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.CVE-2026-58094 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.8
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target.CVE-2026-77585 · Other software · Okta · reported by psirt@okta.comMedium 5.3
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.
- Product
- Okta Privileged Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any applicCVE-2026-43798 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.
- Product
- swift-nio-ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-76918 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53549 · Other software · Termix-SSH · reported by GitHubHigh 7.7
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53548 · Other software · Termix-SSH · reported by GitHubCritical 9.6
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53547 · Other software · Termix-SSH · reported by GitHubHigh 8.8
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53546 · Other software · Termix-SSH · reported by GitHubCritical 9.6
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53545 · Other software · Termix-SSH · reported by GitHubCritical 9.8
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-53542 · Other software · Termix-SSH · reported by GitHubHigh 8.8
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-49255 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-49253 · Other software · electerm · reported by GitHubHigh 7.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026SSHFS is a network filesystem client for connecting to SSH servers.CVE-2026-48711 · Other software · libfuse · reported by GitHubHigh 7
SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.
- Product
- sshfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026SSHFS is a network filesystem client for connecting to SSH servers.CVE-2026-47187 · Other software · libfuse · reported by GitHubCritical 9.3
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6.
- Product
- sshfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an admiCVE-2026-24185 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.
- Product
- NVOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 18, 2026SSH.NET is a Secure Shell (SSH) library for .NET.CVE-2026-48798 · Other software · sshnet · reported by GitHubHigh 7.1
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
- Product
- SSH.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Russh is a Rust SSH client & server library.CVE-2026-73489 · Other software · Eugeny · reported by GitHubMedium 4.3
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry [(Pty::TTY_OP_END, 0); 130] array but continues increasing the mode count, then constructs an out-of-bounds slice and panics before the application pty_request handler runs. The panic terminates the server session task without causing memory corruption. This issue is fixed in version 0.62.4.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to foCVE-2026-67614 · Other software · usmannasir · reported by VulnCheckCritical 9.3
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
- Product
- cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberpanel.netgithub.com
Aug 13, 2026Gitea SSH Key Parser Denial of ServiceCVE-2026-56657 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.2
Gitea SSH Key Parser Denial of Service
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Aug 12, 2026Russh is a Rust SSH client & server library.CVE-2026-73430 · Other software · Eugeny · reported by GitHubMedium 5.3
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which compute_exchange_hash calls encode_mpint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Russh is a Rust SSH client & server library.CVE-2026-73429 · Other software · Eugeny · reported by GitHubMedium 5.3
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that aCVE-2026-5917 · Other software · libgit2 · reported by VulnCheckHigh 8.6
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
- Product
- libgit2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 11, 2026In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.CVE-2026-73283 · Other software · OpenBSD · reported by MITRELow 2.5
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.CVE-2026-73282 · Other software · OpenBSD · reported by MITREMedium 4.8
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keyCVE-2026-73281 · Other software · OpenBSD · reported by MITRELow 3.5
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73227 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73226 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73225 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73224 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73223 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allowsCVE-2026-71991 · Other software · MSI · reported by VulnCheckCritical 9.3
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.
- Product
- Radix AXE6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows reCVE-2026-71990 · Other software · MSI · reported by VulnCheckCritical 9.3
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.
- Product
- Radix AXE6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5.CVE-2026-19039 · Other software · Kino-Kafkaesque · reported by VulDBLow 1.9
A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: "The intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell."
- Product
- ssh-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH.CVE-2026-48113 · Other software · jpillora · reported by GitHubHigh 8.5
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client can authenticate with a permitted remote, then open channels to any host:port it wants. This issue has been fixed in version 1.11.5.
- Product
- chisel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-mCVE-2026-18654 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.9
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
- Product
- aws-cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.