PT-2026-70930

Name of the Vulnerable Software and Affected Versions libgit2 versions 0.27.0 through 1.9.0 Description Remote attackers can execute arbitrary commands on an SSH server when the software is built with the libssh2 SSH backend USE SSH=libssh2. The issue occurs because the gen proto function in ssh...

CVE-2026-73281: Incorrect Resource Transfer Between Spheres

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

RHCOS 4 : OpenShift Container Platform 4.22.9 (RHSA-2026:51036)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51036 advisory. - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 -...

OpenSSH -- Multiple vulnerbilities

The OpenSSH project reports: ssh-agent1: fix an interaction between agent locking and the [email protected] extension that is used to identify forwarded agents. ssh1: avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing...

PT-2026-70883

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.5 Description A misinteraction between agent locking and the [email protected] extension in ssh-agent allows certain operations intended only for local use to be performed remotely. This occurs because a...

...[ More ]

A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...

MAL-2026-13775 Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

CVE-2026-73282: Use After Free

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72882

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...

CVE-2026-71965

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...

CVE-2025-13293

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

EUVD-2026-55799

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

EUVD-2026-55790

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...

CVE-2026-72882

Dokploy: CVE-2026-72882 affects Dokploy 0.28.8 and earlier. An authenticated user who can create or update file mounts can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment...

CVE-2026-72882

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed serv...