Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

519 matches found

osv_clsa
osv_clsa•added 2026/09/04 4:37 p.m.•9 views

CLSA-2026-1788539811 rsync: Fix of 4 CVEs

CVE-2026-53784: resolve an absolute daemon path one component at a time with an ONOFOLLOW dirfd per level so a planted symlink cannot steer the daemon CWD outside the module when "use chroot = no" - CVE-2026-53791: require the direct peer to match the new "proxy protocol hosts" list before a...

9.1CVSS6.9AI score0.00501EPSS
SaveExploits1References5
osv_cleanstart
osv_cleanstart•added 2026/09/04 12:43 a.m.•20 views

CLEANSTART-2026-QE70350 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the tekton-chains-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...

9.8CVSS5.8AI score0.00437EPSS
SaveExploits0References8
osv_cleanstart
osv_cleanstart•added 2026/09/04 12:39 a.m.•18 views

CLEANSTART-2026-XF15574 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the octo-sts package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

9.8CVSS5.8AI score0.00437EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE•added 2026/09/04 12:23 a.m.•29 views

SUSE CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

8.1CVSS6AI score0.00437EPSS
SaveExploits0References30
NVD
NVD•added 2026/09/01 8:17 p.m.•17 views

CVE-2026-73742

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

4.3CVSS0.00254EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/09/01 7:47 p.m.•22 views

EUVD-2026-69469

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

4.3CVSS5.8AI score0.00254EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies•added 2026/09/01 12:00 a.m.•24 views

PT-2026-84446

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

4.3CVSS5.8AI score0.00254EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/09/01 12:00 a.m.•10 views

CVE-2026-73742: Authentication Bypass by Spoofing

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

4.3CVSS5.8AI score0.00254EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus•added 2026/08/29 12:00 a.m.•46 views

Linux Distros Unpatched Vulnerability : CVE-2026-56854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and...

10CVSS6.5AI score0.00556EPSS
SaveExploits1References3
NVD
NVD•added 2026/08/28 4:18 p.m.•26 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS0.00437EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve•added 2026/08/28 4:18 p.m.•22 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS6AI score0.00437EPSS
SaveExploits0References5
osv_ubuntu
osv_ubuntu•added 2026/08/28 4:18 p.m.•24 views

UBUNTU-CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS6AI score0.00437EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE•added 2026/08/28 4:07 p.m.•20 views

CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...

7.5CVSS5.8AI score0.00437EPSS
SaveExploits0References6
EUVD
EUVD•added 2026/08/28 3:14 p.m.•24 views

EUVD-2026-67741

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS5.9AI score0.00437EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/08/28 3:14 p.m.•28 views

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

6AI score0.00437EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/08/28 3:14 p.m.•187 views

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

0.00437EPSS
SaveExploits0References3
Debian CVE
Debian CVE•added 2026/08/28 3:14 p.m.•31 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS5.9AI score0.00437EPSS
SaveExploits0
CVE
CVE•added 2026/08/28 3:14 p.m.•306 views

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where the source-address critical option in permissions returned by certain authentication callbacks was not validated. Specifically, the check was only enforced for PublicKeyCallback and VerifiedPublicKeyCallback , meaning restrictio...

7.5CVSS6AI score0.00437EPSS
SaveExploits0References3
Mend
Mend•added 2026/08/28 3:14 p.m.•11 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

8.7CVSS6AI score0.00437EPSS
SaveExploits0References3
osv_go
osv_go•added 2026/08/28 2:47 p.m.•34 views

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS6.5AI score0.00556EPSS
SaveExploits1References2
Rows per page
Query Builder