| CVE-2026-35387 |
OpenSSH before 10.3 can use unintended ECDSA algorithms
|
3.1
Low
|
Apr 2, 2026 |
| CVE-2026-35386 |
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line
|
3.6
Low
|
Apr 2, 2026 |
| CVE-2026-35385 |
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users'…
|
7.5
High
|
Apr 2, 2026 |
| CVE-2025-61985 |
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a…
|
3.6
Low
|
Oct 6, 2025 |
| CVE-2025-61984 |
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted…
|
3.6
Low
|
Oct 6, 2025 |
| CVE-2025-32728 |
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it…
|
4.3
Medium
|
Apr 10, 2025 |
| CVE-2024-39894 |
OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and…
|
7.5
High
|
Jul 2, 2024 |
| CVE-2020-15778 |
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick…
|
7.8
High
|
Jul 24, 2020 |