Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 381

Export CSV
CVE-2023-38408

openssh: Remote code execution in ssh-agent PKCS#11 support

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

CVSS 3.1 · 9.8 Critical EPSS 79.7% KEV · Not listed
Vendors
Fedoraproject Openbsd Redhat
Products
Fedora Openssh Devworkspace and 6 more
CVE-2023-25136

openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

CVSS 3.1 · 6.5 Medium EPSS 89.8% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 1 more
Products
Fedora 500f 500f Firmware and 7 more
CVE-2021-41617

openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVSS 3.1 · 7.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 3 more
Products
Fedora Active Iq Unified Manager Aff 500f and 12 more
CVE-2021-28041

openssh: double-free memory corruption may lead to arbitrary code execution

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVSS 3.1 · 7.1 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 1 more
Products
Fedora Cloud Backup Hci Compute Node and 8 more
CVE-2020-15778

openssh: scp allows command injection when using backtick characters in the destination argument

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

CVSS 3.1 · 7.8 High EPSS 13.7% KEV · Not listed
Vendors
Broadcom Netapp Openbsd and 1 more
Products
Fabric Operating System A700s A700s Firmware and 8 more
CVE-2020-14145

openssh: Observable discrepancy leading to an information leak in the algorithm negotiation

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Netapp Openbsd Redhat
Products
Active Iq Unified Manager Aff A700s Aff A700s Firmware and 8 more
CVE-2020-12062

openssh: scp can send duplicate responses to the server upon a utimes system call failure leading to overwrite of arbitrary files

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2019-6111

openssh: Improper validation of object names allows malicious server to overwrite files via scp client

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 5.9 Medium EPSS 58.2% KEV · Not listed
Vendors
Apache Canonical Debian and 7 more
Products
Mina Sshd Ubuntu Linux Debian Linux and 24 more
CVE-2019-6110

openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVSS 3.1 · 6.8 Medium EPSS 24.9% KEV · Not listed
Vendors
Netapp Openbsd Siemens and 1 more
Products
Element Software Ontap Select Deploy Storage Automation Store and 6 more
CVE-2019-6109

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS 3.1 · 6.8 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2019-16905

openssh: an integer overflow in the private key parsing code for the XMSS key type

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Netapp Openbsd Siemens
Products
Cloud Backup Steelstore Cloud Integrated Storage Openssh and 4 more
CVE-2026-106552

openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106553

openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106582

openssh: openssh: Information disclosure via shared compression side-channel

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106584

openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106586

openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106587

openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106555

openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-106589

openssh: OpenSSH: Privilege escalation via retained root privileges in sshd-session

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh