PT-2026-84454

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the SSH daemon allows an unauthenticated remote attacker to gain administrative access to affected hosts. This could enable the execution of arbitrary command...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

MiracleLinux 9 : curl-7.76.1-40.el9_8.5.ML.1 (AXSA:2026-1712:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1712:05 advisory. curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl: Information disclosure v...

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...

libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation

A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution...

libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution...

libssh2: libssh2: Arbitrary code execution via double-free in SFTP session

A flaw was found in libssh2. A malicious SSH Secure Shell server can exploit a double-free vulnerability in the sftpopen function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP SSH File Transfer Protocol session. This heap corruption can...

[SECURITY] Fedora 44 Update: opkssh-0.16.0-2.fc44

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

[SECURITY] Fedora 43 Update: opkssh-0.16.0-2.fc43

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

CVE-2026-45570

A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell SSH communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a...

cowrie v3.0.12

.. SPDX-FileCopyrightText: 2014 Upi Tamminen [email protected] .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof [email protected] .. .. SPDX-License-Identifier: BSD-3-Clause Cowrie What is Cowrie Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute...

Fedora 43 : curl (2026-f903f9ff11)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f903f9ff11 advisory. - fix proto-default skips SSH verification CVE-2026-12064 - fix wrong STARTTLS connection reuse CVE-2026-8286 - fix SASL double-free CVE-2026-8925 -...

SUSE SLES12 Security Update : curl (SUSE-SU-2026:3814-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3814-1 advisory. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. -...

warpgate v0.28.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

chisel v1.12.0

Chisel Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go golang. Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Table of...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

UBUNTU-CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where the source-address critical option in permissions returned by certain authentication callbacks was not validated. Specifically, the check was only enforced for PublicKeyCallback and VerifiedPublicKeyCallback , meaning restrictio...