OT
Product
OTP
On CISA KEVExploited in the wild
66
CVEs
1
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 6High 28Medium 26Low 4
Watch
Add OTP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-49760 | 5.5 | Jun 10 | Stack Buffer Overflow in ei_s_print_term at Very Large Integer Affected: 17.0; 3.7.16; 84adefa331c4159d432d22840663c38f155cd4c1 before 0bef277b2d39dc8babb9ceb4f5d0a456f3007111 |
| CVE-2026-23942 | 5.4 | Mar 13 | SFTP root escape via component-agnostic prefix check in ssh_sftpd Affected: 3.0.1; 17.0; 84adefa331c4159d432d22840663c38f155cd4c1 |
| CVE-2026-48859 | 5.3 | Jun 10 | SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration Affected: 29.0 before 29.0.2; 6.0 before 6.0.1; 032d1bc9491a3975c68faf9bc7776115d6ae3005 before c342092ef4b369bb409d5b71ac8fd83bab74aedf |
| CVE-2026-23943 | 5.3 | Mar 13 | Pre-auth SSH DoS via unbounded zlib inflate Affected: 3.0.1; 17.0; 07b8f441ca711f9812fad9e9115bab3c3aa92f79 |
| CVE-2026-47078 | 4.8 | Jul 27 | Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass Affected: 27.1; 6.1; 8d537f51a4262d24f3395c4148323eaca9facbbd before 8a933c9c7835b06776d31d17b79b7336627d887a |
| CVE-2026-54887 | 4.8 | Jul 2 | DTLS server cookie bypass during startup window due to empty initial cookie secret Affected: 8.2; 20.0; e594aad2f87aab39e99fccf9e021bc94e0bbf7d4 before 888e3bcd72d5406016b9e0de741026bc2a6f114d |
| CVE-2026-42789 | 4.8 | May 27 | Non-CA certificate accepted as intermediate issuer in public_key path validation Affected: 17.0; 0.22; 84adefa331c4159d432d22840663c38f155cd4c1 |
| CVE-2026-54886 | 4.3 | Jul 2 | SSH SFTP server denial of service via extended channel data infinite loop Affected: 3.0.1; 17.0; 84adefa3318eef8631bf25cd233246a86eea18cd before eaf9550b8ad4738b81149d3f617102d980c6dd18 |
| CVE-2026-53422 | 4.3 | Jul 2 | SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root Affected: 3.0.1; 17.0; 84adefa331c4159d432d22840663c38f155cd4c1 |
| CVE-2026-32147 | 4.3 | Apr 21 | SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT Affected: 3.01; 17.0; 07b8f441ca711f9812fad9e9115bab3c3aa92f79 |
| CVE-2026-54891 | 3.7 | Jul 2 | Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl Affected: 17.0 before 27.3.4.14; 28.0 before 28.5.0.3; 29.0 before 29.0.3; 5.3.4 before 11.2.12.10; 11.3 before 11.6.0.3; 11.7 before 11.7.3; +1 more |
| CVE-2026-42791 | 3.7 | May 27 | OCSP responder certificate validity period not checked in public_key Affected: 1.16; 27.0; 2b1a742c651b90f8a7a1fb2ddde73f29915ea376 |
| CVE-2026-28810 | 3.7 | Apr 7 | Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver Affected: 3.0; 17.0; 07b8f441ca711f9812fad9e9115bab3c3aa92f79 |
| CVE-2026-21620 | 2.3 | Feb 20 | TFTP Path Traversal Affected: 17.0; 07b8f441ca711f9812fad9e9115bab3c3aa92f79; 5.10 before 7.0; 1.0 |
| CVE-2014-1693 | – | Dec 8 | Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1)… Affected: r15b03 |
| CVE-2011-0766 | – | May 31 | The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on… Affected: r11b-5; r12b-5; r13b; r13b02-1; r13b03; r13b04; +4 more |