CVE-2026-106586

A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB’s UnRAR version prior to 6.12 on Linux and UNIX allowed directory traversal, enabling writing to files during an extraction operation also known as unpacking. This was demonstrated by creating a file named /.ssh/authorizedkeys. NOTE: WinRAR and Android RAR are not affected by this issue...

OESA-2026-4087 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...

OESA-2026-4086 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...

OESA-2026-4085 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...

OESA-2026-4084 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...

PT-2026-95491

Name of the Vulnerable Software and Affected Versions btrbk versions 0.29.0 through 0.32.6 Description The ssh filter btrbk.sh script constructs allow stream match using a start anchor but lacks an end-of-string anchor for the complete command. This allows a user restricted by an authorized keys...

CVE-2026-90767

Froxlor versions before 2.3.12 contain an SSH key injection vulnerability in the SshKeys::add() API endpoint. The root cause is improper validation of multi-line SSH public keys , allowing customers to inject arbitrary lines into authorized_keys files. An attacker can exploit this to inject malic...

EUVD-2026-76988

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

EUVD-2026-42400

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading and weakly via $ENV username substitution...

...[ More ]

A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...

CVE-2026-70615

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

EUVD-2026-53584

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615

Boringproxy 0.10.0 is affected by a newline injection in the tunnel-creation endpoint’s domain parameter, enabling authenticated, low-privilege users with tunnel-creation permission to inject lines into the SSH authorized_keys file. This may allow insertion of an unrestricted public key, granting...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

CVE-2026-71269

CVE-2026-71269 affects Node-RED versions 3.0.0 through 5.0.4 (running on Node.js ≥ 15). The local-filesystem library storage module (saveLibraryEntry in library.js) joins a user-supplied path via fspath.join(libDir, type, path) with no traversal sanitization. A bare .. segment passes the is_malic...

EUVD-2026-53354

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

PT-2026-68310

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description Authenticated low-privileged users with tunnel-creation permissions can perform a newline injection. By providing a percent-encoded newline character in the domain parameter of the tunnel creati...

Malicious code in nagix-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...