18794 matches found
Updated erlang package fixes security vulnerabilities
SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...
Erlang/OTP 27.3.2 SSH Remote Code Execution
Erlang/OTP SSH server versions prior to patched releases 27.3.3, 26.2.5.11, and 25.3.2.20 contain an SSH protocol message-handling flaw that can allow unauthenticated remote code execution. This submission provides vulnerability background and patch-analysis notes...
log-sentinel
log-sentinel !CIhttps://github.com/07espigares/log-sentin...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
EUVD-2026-87686
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-100713
Froxlor versions 2.3.10 and earlier are vulnerable to a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php ). The flaw exists because symlink validation occurs only at check time, while the filesystem path is re-resolved as r...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
Exploit for Improper Enforcement of Behavioral Workflow in Mikrotik Routeros
MikroTik RouterOS PoC Collection This repository contains pro...
CLEANSTART-2026-OJ26404 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CLEANSTART-2026-PN24745 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...
CLEANSTART-2026-TA77263 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
Security vulnerability affects the loki package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...
CLEANSTART-2026-UN89941 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...
Security vulnerability affects the loki package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...
CLEANSTART-2026-CG56781 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...
CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...
PT-2026-99384
Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description A time-of-check time-of-use TOCTOU race condition exists in the SSH key synchronization cron within the SshKeys::generateFiles function located in lib/Froxlor/Cron/System/SshKeys.php. TOCTOU is a...
Go x/crypto v0.51.0 SSH Authorization Bypass
Go golang.org/x/crypto versions before v0.52.0 contain an authorization bypass in certain SSH server configurations. This proof of concept creates a reachable SSH server path for vulnerability-scanner testing...
openSUSE 16 Security Update : python-asyncssh (openSUSE-SU-2026:21953-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21953-1 advisory. Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972 Tenable has extracte...
CVE-2026-100713: Time-of-check Time-of-use (TOCTOU) Race Condition
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...