CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where the source-address critical option in permissions returned by certain authentication callbacks was not validated. Specifically, the check was only enforced for PublicKeyCallback and VerifiedPublicKeyCallback , meaning restrictio...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

EUVD-2026-67741

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-72846

creationtimestamp| type| source ---|---|--- 2026-08-28 15:00:05+00:00| published-proof-of-concept| https://t.me/bdufstecru/3417 2026-08-29 00:00:09+00:00| published-proof-of-concept| https://t.me/bdufstecru/3417...

Incorrect Authorization

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and...

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-82222

creationtimestamp| type| source ---|---|--- 2026-08-28 14:07:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu5jwrpbtc24 2026-08-29 00:00:07+00:00| seen| https://t.me/captainsmok3rofficial/506 2026-08-29 02:56:11+00:00| seen|...

CVE-2026-42007

creationtimestamp| type| source ---|---|--- 2026-08-28 14:07:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu5jwjpibm2c 2026-08-29 05:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu76lzhide2t 2026-08-29 23:40:03+00:00| seen|...

CVE-2026-18918

creationtimestamp| type| source ---|---|--- 2026-08-28 14:07:23+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu5jwayaco2y 2026-08-29 05:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu76265dqq24 2026-10-11 06:11:15+00:00| seen|...

CVE-2026-9576

creationtimestamp| type| source ---|---|--- 2026-08-28 13:00:05+00:00| seen| Telegram/CfRvWZv5RrUF8689qv7kg16a3mW0159b7rTcNr-wYLT-sQY 2026-08-29 00:00:09+00:00| seen| Telegram/CfRvWZv5RrUF8689qv7kg16a3mW0159b7rTcNr-wYLT-sQY...

CVE-2025-46445

creationtimestamp| type| source ---|---|--- 2026-08-28 13:00:05+00:00| seen| Telegram/hQtzv6DL4WYG9-NneOqiV4oOQsP1iV4KS9tubsFUfnleU 2026-08-28 13:00:05+00:00| seen| https://t.me/ProfessorDiscussions/30213 2026-08-29 00:00:08+00:00| seen| https://t.me/ProfessorDiscussions/30213 2026-08-29...

CVE-2026-55583

creationtimestamp| type| source ---|---|--- 2026-08-28 13:00:05+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU 2026-08-29 00:00:09+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU...

WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability

Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability discovered by Artus KG in WordPress Plugin Bit File Manager versions 6.9.1...

WordPress WP Rocket plugin <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint vulnerability

Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocketbeacon Endpoint vulnerability discovered by WordFence in WordPress Plugin WP Rocket versions = 3.21.0.1...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...