CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

K000164144: OpenSSH vulnerability CVE-2026-123158

Security Advisory Description sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password...

Vulnerability fixed in OpenSSH by the OpenSSH Project

The OpenSSH project has addressed a vulnerability in sshd on OpenSSH versions older than 10.6p2. The vulnerability affects Linux systems that use musl libc and do not employ PAM. It involves bypassing SSH password authentication when using passwords with lengths ranging from 257 to 1024 bytes. Th...

CVE-2026-123158

A flaw was found in OpenSSH. When running on Linux systems utilizing the musl standard C library without Pluggable Authentication Modules PAM, the SSH server can misinterpret input strings as password hashes. A remote, unauthenticated attacker can exploit this flaw by submitting a specially sized...

Linux Distros Unpatched Vulnerability : CVE-2026-123158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation...

UBUNTU-CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

enumpossible

enumpossible Checks a list of SSH servers for password-based auth availability and for the existence of SSH user enumeration vulnerability CVE-2018-15473 in those identified. Uses a slightly modified version of https://www.exploit-db.com/exploits/45939 by @LeapSecurity to check for CVE-2018-15473...

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

EUVD-2026-117552

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-123158

The sshd component in OpenSSH before version 10.6p2 on Linux is vulnerable to a password authentication bypass . This issue occurs specifically when musl libc is used without PAM , as the system misinterprets whether a string is a password or a password hash. Under certain account configurations,...

PT-2026-137533

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.6p2 Description An authentication bypass exists in the sshd server when running on Linux systems that use the musl libc library without PAM Pluggable Authentication Modules. The issue arises from a misinterpretatio...

kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // ||...

extloader

extLoader A small toolkit for managing and deploying unpacked Chromium extensions. Find out more in the following blogpost: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways Installation Direct install pipx pipx install . extloader --hel...

CVE-2023-50564

CVE-2023-50564 How to use First setup a listener for the reverse shell. Terminal 1 nc -nlvp Execute the script which will attempt to install a pluck module sending the reverse shell back to us. Terminal 2 go run exploit.go -url -password -i -p...

PT-2026-132835

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions 3.0.0 through 3.3.6 MariaDB Connector/J versions 3.4.0 through 3.4.4 Description During caching sha2 password authentication, the authentication-more-data response is processed as a length-encoded byte array. Memor...

Security Bulletin:Multiple vulnerabilities in postgresql may affect IBM Infosphere Change Data Capture (CVE-2026-107314, CVE-2026-107315)

Summary Multiple security vulnerabilities have been identified in postgresql, PostgreSQL JDBC Driver Postgresql. postgresql is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...