# OpenBSD OpenSSH.

Every CVE that names OpenBSD OpenSSH among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM…](https://agentprime.io/advisories/CVE-2026-123158.md)
  `CVE-2026-123158` · CVE record: OpenBSD OpenSSH · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-394
- [OpenBSD OpenSSH: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username…](https://agentprime.io/advisories/CVE-2026-106583.md)
  `CVE-2026-106583` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-99
- [OpenBSD OpenSSH: In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer…](https://agentprime.io/advisories/CVE-2026-106589.md)
  `CVE-2026-106589` · CVE record: OpenBSD OpenSSH · CVSS 2.9 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-272
- [OpenBSD OpenSSH: In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect…](https://agentprime.io/advisories/CVE-2026-106588.md)
  `CVE-2026-106588` · CVE record: OpenBSD OpenSSH · CVSS 3.1 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-653
- [Type confusion in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-106587.md)
  `CVE-2026-106587` · CVE record: OpenBSD OpenSSH · CVSS 3.6 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to…](https://agentprime.io/advisories/CVE-2026-106586.md)
  `CVE-2026-106586` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-670
- [OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…](https://agentprime.io/advisories/CVE-2026-106585.md)
  `CVE-2026-106585` · CVE record: OpenBSD OpenSSH · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-409
- [Off-by-one error in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-106584.md)
  `CVE-2026-106584` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-193
- [OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…](https://agentprime.io/advisories/CVE-2026-106582.md)
  `CVE-2026-106582` · CVE record: OpenBSD OpenSSH · CVSS 3.7 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-514
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly…](https://agentprime.io/advisories/CVE-2026-106555.md)
  `CVE-2026-106555` · CVE record: OpenBSD OpenSSH · CVSS 2.2 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-669
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a…](https://agentprime.io/advisories/CVE-2026-106553.md)
  `CVE-2026-106553` · CVE record: OpenBSD OpenSSH · CVSS 2.2 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-669
- [Path traversal in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-106552.md)
  `CVE-2026-106552` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to…](https://agentprime.io/advisories/CVE-2026-73283.md)
  `CVE-2026-73283` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-670
- [Use after free in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-73282.md)
  `CVE-2026-73282` · CVE record: OpenBSD OpenSSH · CVSS 4.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [OpenBSD OpenSSH: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended…](https://agentprime.io/advisories/CVE-2026-73281.md)
  `CVE-2026-73281` · CVE record: OpenBSD OpenSSH · CVSS 3.5 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-669
- [Use after free in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-60002.md)
  `CVE-2026-60002` · CVE record: OpenBSD OpenSSH · CVSS 7.7 High · Not analysed yet · Published 8 Jul 2026 · Tags: Memory corruption
- [Resource allocation without limits in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-60001.md)
  `CVE-2026-60001` · CVE record: OpenBSD OpenSSH · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service
- [Resource allocation without limits in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-60000.md)
  `CVE-2026-60000` · CVE record: OpenBSD OpenSSH · CVSS 3.7 Low · Not analysed yet · Published 8 Jul 2026 · Tags: Denial of service
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…](https://agentprime.io/advisories/CVE-2026-59999.md)
  `CVE-2026-59999` · CVE record: OpenBSD OpenSSH · CVSS 5.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-348
- [OpenBSD OpenSSH: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior…](https://agentprime.io/advisories/CVE-2026-59998.md)
  `CVE-2026-59998` · CVE record: OpenBSD OpenSSH · CVSS 4.8 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-573
- [OpenBSD OpenSSH: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line…](https://agentprime.io/advisories/CVE-2026-59997.md)
  `CVE-2026-59997` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-1284
- [Path traversal in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-59996.md)
  `CVE-2026-59996` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Path traversal
- [Path traversal in OpenBSD OpenSSH](https://agentprime.io/advisories/CVE-2026-59995.md)
  `CVE-2026-59995` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Path traversal
- [OpenBSD OpenSSH: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon…](https://agentprime.io/advisories/CVE-2026-35414.md)
  `CVE-2026-35414` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-670
- [OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.](https://agentprime.io/advisories/CVE-2026-35388.md)
  `CVE-2026-35388` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-420
- [OpenSSH before 10.3 can use unintended ECDSA algorithms.](https://agentprime.io/advisories/CVE-2026-35387.md)
  `CVE-2026-35387` · CVE record: OpenBSD OpenSSH · CVSS 3.1 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-670
- [OpenBSD OpenSSH: In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…](https://agentprime.io/advisories/CVE-2026-35386.md)
  `CVE-2026-35386` · CVE record: OpenBSD OpenSSH · CVSS 3.6 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-696
- [OpenBSD OpenSSH: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid…](https://agentprime.io/advisories/CVE-2026-35385.md)
  `CVE-2026-35385` · CVE record: OpenBSD OpenSSH · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-281
- [OpenBSD OpenSSH: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI…](https://agentprime.io/advisories/CVE-2025-61985.md)
  `CVE-2025-61985` · CVE record: OpenBSD OpenSSH · CVSS 3.6 Low · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-158
- [OpenBSD OpenSSH: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from…](https://agentprime.io/advisories/CVE-2025-61984.md)
  `CVE-2025-61984` · CVE record: OpenBSD OpenSSH · CVSS 3.6 Low · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-159
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the…](https://agentprime.io/advisories/CVE-2025-32728.md)
  `CVE-2025-32728` · CVE record: OpenBSD OpenSSH · CVSS 4.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-440

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=openbsd-openssh>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/openbsd-openssh/>. Everything for agents: <https://agentprime.io/llms.txt>.