OP
Product
OpenSSH
150
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 7High 30Medium 37Low 14
Watch
Add OpenSSH to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35414 | 8.1 | Apr 2 | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes… Affected: before 10.3 |
| CVE-2026-35386 | 8.1 | Apr 2 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line Affected: before 10.3 |
| CVE-2026-35385 | 8.1 | Apr 2 | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O… Affected: before 10.3 |
| CVE-2024-6387 | 8.1 | Jul 1 | Openssh: regresshion - race condition in ssh allows rce/dos Affected: before 4.4; 8.6 through 9.8; 4.4; 8.5; 8.6 |
| CVE-2016-0778 | 8.1 | Jan 14 | The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are… Affected: 5.4; 5.4; 5.5; 5.5; 5.6; 5.6; +31 more |
| CVE-2015-5600 | 8.1 | Aug 3 | The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single… Affected: through 6.9 |
| CVE-2006-5051 | 8.1 | Sep 27 | Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is… Affected: through 4.4 |
| CVE-2026-106583 | 7.8 | Oct 6 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection Affected: before 10.6 |
| CVE-2019-16905 | 7.8 | Oct 9 | OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a… Affected: 7.7 through 7.9; 8.0 before 8.1 |
| CVE-2016-10012 | 7.8 | Jan 5 | The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which… Affected: through 7.3 |
| CVE-2015-8325 | 7.8 | May 1 | The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home… Affected: through 7.2 |
| CVE-2026-106555 | 7.5 | Oct 6 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts Affected: before 10.6 |
| CVE-2026-106553 | 7.5 | Oct 6 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt Affected: before 10.6 |
| CVE-2026-60000 | 7.5 | Jul 8 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled… Affected: before 10.4 |
| CVE-2026-59999 | 7.5 | Jul 8 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not Affected: before 10.4 |
| CVE-2026-3497 | 7.5 | Mar 12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions Affected: All versions, or not specified |
| CVE-2020-12062 | 7.5 | Jun 1 | The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote… Affected: 8.2 |
| CVE-2016-10708 | 7.5 | Jan 21 | sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated… Affected: before 7.4 |
| CVE-2016-8858 | 7.5 | Dec 9 | The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate… Affected: 6.8; 6.9; 7.0; 7.1; 7.2; 7.3 |
| CVE-2016-6515 | 7.5 | Aug 7 | The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a… Affected: through 7.2 |
| CVE-2010-5107 | 7.5 | Mar 7 | The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote… Affected: through 6.1; 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; +34 more |
| CVE-2011-0539 | 7.5 | Feb 10 | The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the… Affected: 5.6; 5.7 |
| CVE-2020-15778 | 7.4 | Jul 24 | scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument Affected: before 8.3; 8.3; 8.3 |
| CVE-2016-10009 | 7.3 | Jan 5 | Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over… Affected: through 7.3 |
| CVE-2014-1692 | 7.3 | Jan 29 | The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might… Affected: through 6.4 |
| CVE-2021-28041 | 7.1 | Mar 5 | ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or… Affected: 8.2 before 8.5 |
| CVE-2023-51767 | 7.0 | Dec 24 | OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in… Affected: All versions, or not specified |
| CVE-2021-41617 | 7.0 | Sep 26 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as… Affected: 6.2 before 8.8 |
| CVE-2016-10010 | 7.0 | Jan 5 | sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified… Affected: through 7.3 |
| CVE-2015-6564 | 7.0 | Aug 24 | Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges… Affected: through 6.9 |
Showing 30