210579 matches found
openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...
openssh: openssh: Command injection via unvalidated command-line username
A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through...
openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling
A flaw was found in OpenSSH. During certificate generation with the ssh-keygen utility, Daylight Saving Time DST is mishandled when converting dates. This flaw can cause certificates to be issued with incorrect expiration times, potentially allowing them to remain valid longer than intended or...
openssh: openssh: '$' and '\' in a command-line username expand through %u
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...
openssh: openssh: a compressed payload can expand past the maximum packet size
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...
openssh: openssh: sftp can write outside the destination directory from a server-supplied path
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP Secure File Transfer Protocol client. By returning crafted file paths, the remote server can trigger a directory traversal and...
openssh: openssh: Denial of service via oversized decompressed packets
A flaw was found in OpenSSH. A remote attacker can trigger a denial of service DoS or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet...
openssh: openssh: Information disclosure via shared compression side-channel
A flaw was found in OpenSSH. When session compression is enabled, an attacker with access to a shared Secure Shell SSH connection can exploit the compression state shared across multiplexed channels. By analyzing changes in transmitted packet lengths caused by repeated data patterns, the attacker...
CVE-2026-65131
NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-109711
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109757
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109723
Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109704
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109742
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109752
Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109727
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109763
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...