Security Bulletin: Impacted IBM optim versions 1.0.0, 1.1.0 by vulnerability in golang.org/x/crypto/ssh/agent

Summary Impacted IBM optim versions 1.0.0, 1.1.0 by vulnerability in golang.org/x/crypto/ssh/agent, IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2025-47913 DESCRIPTION: SSH clients receiving...

openssh: OpenSSH: ssh-agent allows remote execution of local operations

A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS11 tokens or utilize keys with destination...

openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client

A flaw was found in OpenSSH. A use-after-free vulnerability exists in the ssh client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

SUSE-SU-2026:4272-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272118....

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header. CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272118...

SUSE-SU-2026:4270-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260264. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input...

[SECURITY] Fedora 45 Update: opkssh-0.16.0-3.fc45

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

ALSA-2026:69129 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

RHEL 9 : openssh (RHSA-2026:69130)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69130 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

ALSA-2026:69130 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0333-1 Rating: important References: 1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...

EulerOS Virtualization 2.10.0 : libssh2 (EulerOS-SA-2026-3872)

According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...

PT-2026-96225

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.25.0 through 0.27.5 Description The browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity. Instead, it passes ssh options.host and ssh options.port for the...

PT-2026-96137

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0 Description Templated ACL, PKI, and SSH policies fail to reject syntax-significant characters when substituting attacker-controlled identity data. In ACL templated policies, characters such as asterisks, plus...

Security update for keybase-client (important)

openSUSE Security Update: Security update for keybase-client Announcement ID: openSUSE-SU-2026:0334-1 Rating: important References: 1278586 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE: 8.6...

RHEL 10 : openssh (RHSA-2026:69129)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69129 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

CVE-2026-91166: Improper Validation of Certificate with Host Mismatch

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

Fedora 43 : opkssh (2026-38b019a0f0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38b019a0f0 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...