PT-2026-80562

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...

Oracle Linux 9 : openssh (ELSA-2026-47756)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47756 advisory. - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed in unintended parent directories when scp performs remote-to-remote copy v...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:3605-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3605-1 advisory. - Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. - CVE-2026-59995: sftp:...

OESA-2026-3351 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.CVE-2026-59995 scp in OpenSSH before 10.4 may place a file in the...

OESA-2026-3350 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.CVE-2026-59995 scp in OpenSSH before 10.4 may place a file in the...

Security update for openssh

This update for openssh fixes the following issues: Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled server bsc1271044...

SUSE-SU-2026:3605-1 Security update for openssh

This update for openssh fixes the following issues: - Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled server bsc1271044. -...

GHSA-Q939-RPR3-3284 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...

External Control of File Name or Path

Overview SSH.NET is a Secure Shell SSH library for .NET, optimized for parallelism and with broad framework support. Affected versions of this package are vulnerable to External Control of File Name or Path via server-controlled SCP filenames through the recursive download path in...

K000162881: libcurl vulnerability CVE-2026-9547

Security Advisory Description When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific ke...

PT-2026-76562

Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...

TencentOS Server 4: openssh (TSSA-2026:0821)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0821 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

osTicket Reset Token Auth Bypass (CVE-2026-18363)

CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: password reset tokens are accepted forever because the expiry gate in PasswordResetTokenBackend::signOn never runs for existing tokens. POST the victim's reset token to /scp/pwreset.php to obtain an authenticated agent session; optionally set a...

reverse_ssh v2.8.1

Reverse SSH Art credit to https://www.instagram.com/smart.hedgehog.art/ Want to use SSH for reverse shells? Now you can. Manage and connect to reverse shells with native SSH syntax Dynamic, local and remote forwarding Native SCP and SFTP implementations for retrieving files from your targets Full...

Medium: openssh

Issue Overview: A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes...

openSUSE 16: openssh / openssh-askpass-gnome / openssh-cavs / openssh-clients / etc (openSUSE-SU-2026:21477-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21477-1 advisory. - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled serve...

AlmaLinux 9 : openssh (ALSA-2026:47756)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47756 advisory. openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions CVE-2026-55655 openssh: Double free in...

RLSA-2026:47756 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...

RLSA-2026:47757 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...