17752 matches found
EulerOS Virtualization 2.10.0 : libssh2 (EulerOS-SA-2026-3872)
According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...
PT-2026-96137
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0 Description Templated ACL, PKI, and SSH policies fail to reject syntax-significant characters when substituting attacker-controlled identity data. In ACL templated policies, characters such as asterisks, plus...
PT-2026-96225
Name of the Vulnerable Software and Affected Versions Warpgate versions 0.25.0 through 0.27.5 Description The browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity. Instead, it passes ssh options.host and ssh options.port for the...
Fedora 43 : opkssh (2026-38b019a0f0)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38b019a0f0 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...
Fedora 44 : opkssh (2026-f7b73f165d)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f7b73f165d advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...
UBUNTU-CVE-2026-62943
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...
CVE-2026-62943 btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...
jumpserver v5.0.0
An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English · 中文简体 · 中文繁體 · 日本語 · Português...
SUSE-SU-2026:23924-1 Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh:...
EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-3634)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...
openSUSE 16 Security Update : gh (openSUSE-SU-2026:21861-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21861-1 advisory. Changes in gh: Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH...
SUSE-SU-2026:23874-1 Security update for google-guest-agent
This update for google-guest-agent fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260264. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass an...
SUSE-SU-2026:23745-1 Security update for google-guest-agent
This update for google-guest-agent fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260264. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass an...
Security update for gh (important)
openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21861-1 Rating: important References: bsc1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE : 8.1...
CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...
CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...
CVE-2026-92580
AVideo through 29.0 in the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (~line 270), the stored SSH password is substituted into the command sshpass -p '{password}' rsync ... via a plain str_replace with no escaping, so a single quote bre...
golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...
golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
A flaw was found in golang.org/x/crypto/ssh. The Verify method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially...
