CVE-2026-107675

A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

Versions of FFmpeg through 9.0.2 are vulnerable to a missing SSH host key verification issue within the libssh-based sftp protocol handler . This flaw allows network attackers to perform man-in-the-middle , DNS, or ARP spoofing to impersonate SFTP servers. Consequences include the ability to capt...

PT-2026-108036

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2025-26465

CVE-2025-26465 El cliente OpenSSH contiene un error de lógica entre las versiones 6.8p1 y 9.9p1 ambas incluidas que lo hace vulnerable a un ataque MitM activo si la opción VerifyHostKeyDNS está habilitada, lo que permite a un intruso malicioso hacerse pasar por un servidor legítimo cuando un...

CVE-2026-77703

The HAVELSAN Inc. Liman Render Engine (versions 1.0 before 1.2-75 ) is vulnerable to an SSH Host Key Verification Bypass due to a key exchange without entity authentication. This flaw enables an Adversary in the Middle (AiTM) attack. The vulnerability has a CVSS 3.1 base score of 5.9 (Medium) , i...

CVE-2026-77703 SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

CVE-2026-77703 SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

Astra Linux – Vulnerability in OpenSSH

A vulnerability was discovered in OpenSSH when the VerifyHostKeyDNS option is enabled. A man-in-the-middle attack can be carried out by a malicious machine pretending to be a legitimate server. This issue arises due to the way OpenSSH handles error codes under certain conditions during the...

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the knownhosts parser, where HostKey.name2type lacks OpenSSH certificate-type entries such as [email protected] in its static table, so a @revoked line authored with a...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

SummaryThe AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

GHSA-HQVF-45JJ-MCCQ AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

Important: python-dulwich

Issue Overview: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py. CVE-2026-38974 Arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted...

SUSE SLED15 / SLES15 Security Update : python3-dulwich (SUSE-SU-2026:3459-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3459-1 advisory. This update for python3-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missi...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to disabled SSH host key verification in the EMR SSH helper commands. An attacker can intercept SSH sessions and file transfers by performing a man-in-the-middle attack between the client a...

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...