OpenSSH
by OpenSSH
Source repositories
CVEs (74)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-106583 | Low | 0.16 | 2.5 | 0.00 | Oct 7, 2026 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | ||
| CVE-2026-106586 | Low | 0.16 | 2.5 | 0.00 | Oct 6, 2026 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283. | ||
| CVE-2026-106584 | Low | 0.16 | 2.5 | 0.00 | Oct 6, 2026 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations. | ||
| CVE-2026-35388 | Low | 0.16 | 2.5 | 0.00 | Apr 2, 2026 | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. | ||
| CVE-2015-6565 | 0.03 | — | 0.03 | Aug 24, 2015 | sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence. | |||
| CVE-2010-4755 | 0.01 | — | 0.08 | Mar 2, 2011 | The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory… | |||
| CVE-2026-110923 | 0.00 | — | 0.00 | Oct 15, 2026 | Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552. | |||
| CVE-2011-5000 | 0.00 | — | 0.03 | Apr 5, 2012 | The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be… | |||
| CVE-2008-3259 | 0.00 | — | 0.00 | Jul 22, 2008 | OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform. | |||
| CVE-2008-1657 | 0.00 | — | 0.02 | Apr 2, 2008 | OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file. | |||
| CVE-2008-1483 | 0.00 | — | 0.00 | Mar 24, 2008 | OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by… | |||
| CVE-2007-3102 | 0.00 | — | 0.02 | Oct 18, 2007 | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from… | |||
| CVE-2007-4752 | 0.00 | — | 0.02 | Sep 12, 2007 | ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. | |||
| CVE-2007-4654 | 0.00 | — | 0.02 | Sep 4, 2007 | Unspecified vulnerability in SSHield 1.6.1 with OpenSSH 3.0.2p1 on Cisco WebNS 8.20.0.1 on Cisco Content Services Switch (CSS) series 11000 devices allows remote attackers to cause a denial of service (connection slot exhaustion and device crash) via a series of large packets… |
- risk 0.16cvss 2.5epss 0.00
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
- risk 0.16cvss 2.5epss 0.00
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
- risk 0.16cvss 2.5epss 0.00
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
- risk 0.16cvss 2.5epss 0.00
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
- CVE-2015-6565Aug 24, 2015risk 0.03cvss —epss 0.03
sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.
- CVE-2010-4755Mar 2, 2011risk 0.01cvss —epss 0.08
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory…
- CVE-2026-110923Oct 15, 2026risk 0.00cvss —epss 0.00
Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552.
- CVE-2011-5000Apr 5, 2012risk 0.00cvss —epss 0.03
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be…
- CVE-2008-3259Jul 22, 2008risk 0.00cvss —epss 0.00
OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.
- CVE-2008-1657Apr 2, 2008risk 0.00cvss —epss 0.02
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
- CVE-2008-1483Mar 24, 2008risk 0.00cvss —epss 0.00
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by…
- CVE-2007-3102Oct 18, 2007risk 0.00cvss —epss 0.02
Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from…
- CVE-2007-4752Sep 12, 2007risk 0.00cvss —epss 0.02
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
- CVE-2007-4654Sep 4, 2007risk 0.00cvss —epss 0.02
Unspecified vulnerability in SSHield 1.6.1 with OpenSSH 3.0.2p1 on Cisco WebNS 8.20.0.1 on Cisco Content Services Switch (CSS) series 11000 devices allows remote attackers to cause a denial of service (connection slot exhaustion and device crash) via a series of large packets…
Page 4 of 4