Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,255 results · page 6 of 26
May 22, 2026An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server proCVE-2026-39827 · Other software · golang.org/x/crypto · reported by security@golang.orgMedium 6.5
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed acrCVE-2026-24218 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.1
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.
- Product
- DGX Spark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
May 18, 2026An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/logCVE-2026-39079 · Websites & servers · reported by MITREHigh 7.5
An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/logs/, and /modules/upsshipping/lib/UPSBaseApi.php components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.esokia.comlabs.esokia.com
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44426 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44425 · Other software · shellhub-io · reported by GitHubMedium 5.4
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44424 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44423 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext iCVE-2026-28758 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.7
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-44347 · Other software · warp-tech · reported by GitHubMedium 5.8
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-42454 · Other software · Termix-SSH · reported by GitHubCritical 9.9
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-42453 · Other software · Termix-SSH · reported by GitHubHigh 8.7
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-42452 · Other software · Termix-SSH · reported by GitHubHigh 8.1
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Russh is a Rust SSH client & server library.CVE-2026-42189 · Other software · Eugeny · reported by GitHubHigh 7.5
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43944 · Other software · electerm · reported by GitHubCritical 9.4
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43943 · Other software · electerm · reported by GitHubHigh 7.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43942 · Other software · electerm · reported by GitHubMedium 5.5
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43941 · Other software · electerm · reported by GitHubCritical 9.6
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation. An attacker who controls terminal output (e.g., via a malicious SSH server, compromised remote host, or malicious plugin rendering terminal content) can thus achieve arbitrary code execution or local file access on the victim's machine, requiring only that the victim clicks a displayed link. At time of publication, there are no publicly available patches.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43940 · Other software · electerm · reported by GitHubHigh 8.4
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. This issue has been patched in version 3.7.16.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-41501 · Other software · electerm · reported by GitHubCritical 9.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation. This issue has been patched in version 3.3.8.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-41500 · Other software · electerm · reported by GitHubCritical 9.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Wish is an SSH server with defaults and a collection of middlewares.CVE-2026-41589 · Other software · charmbracelet · reported by GitHubCritical 9.6
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.
- Product
- wish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A security vulnerability has been detected in libssh2 up to 1.11.1.CVE-2026-7598 · Other software · Red Hat · reported by VulDBMedium 6.9
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitCVE-2026-36766 · Other software · reported by MITREMedium 5.4
Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files.CVE-2026-41364 · Other software · OpenClaw · reported by VulnCheckHigh 7.2
OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0.CVE-2026-7039 · Other software · tufantunc · reported by VulDBHigh 7.1
A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- ssh-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026A weakness has been identified in tufantunc ssh-mcp up to 1.5.0.CVE-2026-7038 · Other software · tufantunc · reported by VulDBLow 1.9
A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- ssh-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child procesCVE-2026-41357 · Other software · OpenClaw · reported by VulnCheckLow 2
OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP uCVE-2026-32147 · Other software · Erlang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely. Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector. If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable. This vulnerability is associated with program files lib/ssh/sr
- Product
- OTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Apr 20, 2026Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request.CVE-2026-0930 · Other software · wolfSSL · reported by facts@wolfssl.comLow 2.3
Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output.
- Product
- wolfSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes thaCVE-2026-40461 · Other software · Anviz · reported by ics-cert@hq.dhs.govHigh 7.5
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.
- Product
- Anviz CX7 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in recCVE-2026-32648 · Other software · Anviz · reported by ics-cert@hq.dhs.govMedium 5.3
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.
- Product
- Anviz CX7 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the sCVE-2026-22564 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.8
An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system. Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier) Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later
- Product
- UniFi Play PowerAmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability.CVE-2026-4157 · Other software · ChargePoint · reported by zdi-disclosures@trendmicro.comHigh 7.5
ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26338.
- Product
- Home Flex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impCVE-2025-13914 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7
A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machine-in-the-middle attack on the SSH connections from Apstra to managed devices, enabling an attacker to impersonate a managed device and capture user credentials. This issue affects all versions of Apstra before 6.1.1.
- Product
- Apstra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization.CVE-2026-4631 · Other software · Red Hat · reported by Red HatCritical 9.8
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 7, 2026A flaw was found in libssh.CVE-2025-14821 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 3, 2026Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot beCVE-2015-10148 · Other software · Belden · reported by VulnCheckHigh 8.8
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
- Product
- Hirschmann HiLCOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 2, 2026OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate AuthoriCVE-2026-35414 · Other software · OpenBSD · reported by MITREMedium 4.2
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.CVE-2026-35388 · Other software · OpenBSD · reported by MITRELow 2.5
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OpenSSH before 10.3 can use unintended ECDSA algorithms.CVE-2026-35387 · Other software · OpenBSD · reported by MITRELow 3.1
OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.CVE-2026-35386 · Other software · OpenBSD · reported by MITRELow 3.6
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performeCVE-2026-35385 · Other software · OpenBSD · reported by MITREHigh 7.5
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSHCVE-2026-0968 · Other software · Red Hat · reported by Red HatLow 3.1
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 26, 2026A flaw was found in libssh.CVE-2026-0967 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 26, 2026A flaw was found in libssh.CVE-2026-0966 · Other software · Red Hat · reported by Red HatHigh 8.2
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 26, 2026A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing.CVE-2026-0965 · Other software · Red Hat · reported by Red HatLow 3.3
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 24, 2026An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPCVE-2026-4433 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comLow 1.9
An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host.
- Product
- Tenable Operation Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026Axessh 4.2 contains a stack-based buffer overflow vulnerability in the log file name field that allows local attackers to execute arbitrary code by supplying anCVE-2019-25607 · Other software · Labf · reported by VulnCheckHigh 8.6
Axessh 4.2 contains a stack-based buffer overflow vulnerability in the log file name field that allows local attackers to execute arbitrary code by supplying an excessively long filename. Attackers can overflow the buffer at offset 214 bytes to overwrite the instruction pointer and execute shellcode with system privileges.
- Product
- Axessh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by supplying an excessivCVE-2019-25590 · Other software · Labf · reported by VulnCheckMedium 6.9
Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by supplying an excessively long string in the log file name field. Attackers can enable session logging, paste a buffer of 500 or more characters into the log file name parameter, and trigger a crash when establishing a telnet connection.
- Product
- Axessh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A flaw has been found in janmojzis tinyssh up to 20250501.CVE-2026-4541 · Other software · janmojzis · reported by VulDBLow 1.1
A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.
- Product
- tinyssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.