Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 151

Export CSV
CVE-2026-59996

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-59998

openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-59999

openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-60000

openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-60001

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-60002

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-59995

openssh: OpenSSH: sftp client allows attacker to control downloaded file location

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-59997

openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2016-8858

openssh: Memory exhaustion due to unregistered KEXINIT handler after receiving message

The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

CVSS 3.1 · 7.5 High EPSS 29.5% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2016-6210

openssh: User enumeration via covert timing channel

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

CVSS 3.1 · 5.9 Medium EPSS 88.9% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-3115

openssh: missing sanitisation of input for X11 forwarding

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

CVSS 3.1 · 6.4 Medium EPSS 35.5% KEV · Not listed
Vendors
Openbsd Oracle Redhat
Products
Openssh Vm Server Enterprise Linux
CVE-2016-1908

openssh: possible fallback from untrusted to trusted X11 forwarding

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed
Vendors
Debian Openbsd Oracle and 1 more
Products
Debian Linux Openssh Linux and 7 more
CVE-2016-10012

openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support

The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10011

openssh: Leak of host private key material to privilege-separated child process via realloc()

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10010

openssh: privilege escalation via Unix domain socket forwarding

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.

CVSS 3.1 · 7 High EPSS 4.2% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2016-10009

openssh: loading of untrusted PKCS#11 modules in ssh-agent

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVSS 3.1 · 7.3 High EPSS 37.4% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-0778

OpenSSH: Client buffer-overflow when using roaming connections

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

CVSS 3.1 · 8.1 High EPSS 20.9% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Virtual Customer Access System Openssh and 4 more
CVE-2016-0777

OpenSSH: Client Information leak due to use of roaming connection feature

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

CVSS 3.1 · 6.5 Medium EPSS 63.5% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Remote Device Access Virtual Customer Access System Openssh and 5 more
CVE-2011-4327

openssh: Unauthorized local access to host keys on platforms where ssh-rand-helper used

ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2011-0539

OpenSSH: legacy certificate generation information leak

The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Openbsd
Products
Openssh