CVE-2026-21670

Veeam Backup & Replication versions prior to 13.0.1.2067 are affected by CVE-2026-21670, enabling a low-privileged user to extract saved SSH credentials. The issue is documented in the Veeam KB (KB4831) and is listed with a CVSS v3.1 score of 7.7 (High). Affected deployment types include Windows-...

Veeam Backup And Replication 安全漏洞

Veeam Backup and Replication is a backup and replication software developed by the American company Veeam. Veeam Backup and Replication has a security vulnerability that stems from allowing low-privilege users to extract stored SSH credentials...

CVE-2026-21670: Insufficiently Protected Credentials

A vulnerability allowing a low-privileged user to extract saved SSH credentials...

CVE-2026-32108 Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature the shr global-option. This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the...

EUVD-2025-208581

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys,...

Rapid7 Analysis: CVE-2026-20127

CVE-2026-20127: Cisco Catalyst SD-WAN Authentication Bypass Overview On 25th February 2026, Cisco published an advisory for CVE-2026-20127, a critical authentication bypass vulnerability in the vdaemon service of Cisco Catalyst SD-WAN formerly Viptela. The flaw allows an unauthenticated, remote...

CVE-2025-67035: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys,...

CVE-2025-67035 Lantronix EDS5000 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys,...

CVE-2025-67035

The Lantronix EDS5000 (version 2.1.0.0R3 ) is vulnerable to multiple OS injection flaws located in the SSH Client and SSH Server pages. The root cause is a lack of input sanitization for certain parameters. An attacker can exploit this by injecting arbitrary commands during delete actions for obj...

📄 WatchGuard Firebox Default SSH Credentials

This is a python script to detect whether or not WatchGuard Firebox devices allow unauthorized access via default credentials admin:readwrite on port 4118. =============================================================================================================================================...

CVE-2026-26148

The CVE-2026-26148 issue affects the Microsoft Azure AD SSH Login extension for Linux, causing elevation of privilege. According to the provided metrics, the vulnerability is a LOCAL, high-severity flaw (CVSS 3.1: 8.1) with no required user interaction and no privileges required. The attack compl...

CVE-2026-26148 Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability

...

CLSA-2026-1773161124 Fix CVE(s): CVE-2021-22876, CVE-2025-15079

SECURITY UPDATE: acceptance of hosts not listed in specified knownhosts file during SSH-based transfers - debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same file and fix surprises caused by libssh exposing separate KNOWNHOSTS and GLOBALKNOWNHOSTS options. - CVE-2025-15079...

CLSA-2026-1773153207 curl: Fix of 2 CVEs

CVE-2025-15079: libssh global knownhosts file override - CVE-2025-14524: bearer token leak on cross-protocol redirect...

Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability

External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally...

CLSA-2026-1773135327 curl: Fix of 2 CVEs

CVE-2025-14524: prevent bearer token leak on cross-protocol redirect - CVE-2025-15079: set both SSH knownhosts options to the same file to prevent libssh global knownhosts override...

PT-2026-24241

Уязвимость микропрограммного обеспечения коммутаторов Fortinet FortiSwitchAXFixed связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю выполнить произвольные системные команды с помощью специально созданного конфигурационного файла SSH...

shell command limitation bypass by SSH local config overriding

...

KLA90924 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Azure IOT...

CVE-2026-22628: Improper Access Control

An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file...