CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59997: Improper Validation of Specified Quantity in Input

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

CVE-2026-59995: Relative Path Traversal

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

CVE-2026-59999: Use of Less Trusted Source

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...

CVE-2026-60001: Allocation of Resources Without Limits or Throttling

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

PT-2026-56290

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.4 Description In sshd, the configuration setting DisableForwarding=yes failed to take precedence over PermitTunnel=yes, allowing tunnel forwarding even when it should have been disabled. Recommendations Update to...

CVE-2026-59996: Relative Path Traversal

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...

Linux Distros Unpatched Vulnerability : CVE-2026-59996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. CVE-2026-5999...

CVE-2026-59998: Improper Following of Specification by Caller

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

Linux Distros Unpatched Vulnerability : CVE-2026-60001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. CVE-2026-60001 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2026-59995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is used with an attacker-controlled server...

Linux Distros Unpatched Vulnerability : CVE-2026-59998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

Linux Distros Unpatched Vulnerability : CVE-2026-60002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re- exchange. This outcome occurs only on the client side...

Linux Distros Unpatched Vulnerability : CVE-2026-59999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. CVE-2026-59999 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2026-60000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTrie...

CVE-2026-60000: Allocation of Resources Without Limits or Throttling

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was mishandled for GSSAPIAuthentication...