OP
Product
OpenSSH
150
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 7High 30Medium 37Low 14
Watch
Add OpenSSH to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38408 | 9.8 | Jul 20 | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an… Affected: before 9.3; 9.3; 9.3 |
| CVE-2023-28531 | 9.8 | Mar 17 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints Affected: 8.9 before 9.3 |
| CVE-2016-1908 | 9.8 | Apr 11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows… Affected: before 7.2 |
| CVE-2010-4478 | 9.8 | Dec 6 | OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for… Affected: through 5.6; 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; +34 more |
| CVE-2002-0639 | 9.8 | Jul 3 | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication)… Affected: 2.9.9 through 3.3 |
| CVE-2002-0083 | 9.8 | Mar 15 | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges Affected: 2.0 before 3.1 |
| CVE-2026-60002 | 9.4 | Jul 8 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange Affected: before 10.4 |
Showing 7