| CVE-2026-123158 |
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…
|
8.1
Élevée
|
5 nov. 2026 |
| CVE-2026-106583 |
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection
|
2.5
Faible
|
6 oct. 2026 |
| CVE-2026-106589 |
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can…
|
2.9
Faible
|
6 oct. 2026 |
| CVE-2026-106588 |
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which…
|
3.1
Faible
|
6 oct. 2026 |
| CVE-2026-106587 |
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but…
|
3.6
Faible
|
6 oct. 2026 |
| CVE-2026-106586 |
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel…
|
2.5
Faible
|
6 oct. 2026 |
| CVE-2026-106585 |
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during…
|
6.5
Moyenne
|
6 oct. 2026 |
| CVE-2026-106584 |
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving…
|
2.5
Faible
|
6 oct. 2026 |
| CVE-2026-106582 |
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by…
|
3.7
Faible
|
6 oct. 2026 |
| CVE-2026-106555 |
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across…
|
2.2
Faible
|
6 oct. 2026 |
| CVE-2026-106553 |
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication…
|
2.2
Faible
|
6 oct. 2026 |
| CVE-2026-106552 |
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended…
|
4.2
Moyenne
|
6 oct. 2026 |
| CVE-2026-73283 |
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel…
|
2.5
Faible
|
11 août 2026 |
| CVE-2026-73282 |
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding…
|
4.8
Moyenne
|
11 août 2026 |
| CVE-2026-73281 |
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally,…
|
3.5
Faible
|
11 août 2026 |
| CVE-2026-60002 |
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange
|
7.7
Élevée
|
8 juil. 2026 |
| CVE-2026-60001 |
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay
|
6.5
Moyenne
|
8 juil. 2026 |
| CVE-2026-60000 |
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive…
|
3.7
Faible
|
8 juil. 2026 |
| CVE-2026-59999 |
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not
|
5.9
Moyenne
|
8 juil. 2026 |
| CVE-2026-59998 |
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if…
|
4.8
Moyenne
|
8 juil. 2026 |
| CVE-2026-59997 |
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be…
|
4.2
Moyenne
|
8 juil. 2026 |
| CVE-2026-59996 |
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs…
|
4.2
Moyenne
|
8 juil. 2026 |
| CVE-2026-59995 |
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is…
|
4.2
Moyenne
|
8 juil. 2026 |
| CVE-2026-35414 |
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list…
|
4.2
Moyenne
|
2 avr. 2026 |
| CVE-2026-35388 |
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions
|
2.5
Faible
|
2 avr. 2026 |