EUVD-2026-57624

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429

CVE-2026-73429 affects Russh (Rust SSH client/server library) prior to v0.62.4. A malicious SSH server can trigger a deterministic panic in the client during KEX_ECDH_REPLY handling when the server_ephemeral value is not 32 bytes, as Curve25519Kex::compute_shared_secret passes the decoded value t...

CVE-2026-73429

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-19654 Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

CVE-2026-19654

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

GHSA-G9HV-X236-4QP3 vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-59847 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-JP6G-7MQJ-WJ53 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59843 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-MQ2J-7VQ4-77M8 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X94W-CG8G-G593 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59850 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X5CR-V39M-53GW vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59845 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59846 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-FVWJ-J79Q-57V7 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-6J7F-8JJP-MM8C vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59847 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...