Advisories · Technology

OpenBSD OpenSSH.

Every CVE that names OpenBSD OpenSSH among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-123158 CVE record

CVSS 8.1 High

OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM…
- OpenBSD OpenSSH
- CWE-394
Not analysed yet 5 Nov 2026
CVE-2026-106583 CVE record

CVSS 2.5 Low

OpenBSD OpenSSH: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username…
- OpenBSD OpenSSH
- CWE-99
Not analysed yet 6 Oct 2026
CVE-2026-106589 CVE record

CVSS 2.9 Low

OpenBSD OpenSSH: In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer…
- OpenBSD OpenSSH
- CWE-272
Not analysed yet 6 Oct 2026
CVE-2026-106588 CVE record

CVSS 3.1 Low

OpenBSD OpenSSH: In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect…
- OpenBSD OpenSSH
- CWE-653
Not analysed yet 6 Oct 2026
CVE-2026-106587 CVE record

CVSS 3.6 Low

Type confusion in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Memory corruption
Not analysed yet 6 Oct 2026
CVE-2026-106586 CVE record

CVSS 2.5 Low

OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to…
- OpenBSD OpenSSH
- CWE-670
Not analysed yet 6 Oct 2026
CVE-2026-106585 CVE record

CVSS 6.5 Medium

OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…
- OpenBSD OpenSSH
- CWE-409
Not analysed yet 6 Oct 2026
CVE-2026-106584 CVE record

CVSS 2.5 Low

Off-by-one error in OpenBSD OpenSSH
- OpenBSD OpenSSH
- CWE-193
Not analysed yet 6 Oct 2026
CVE-2026-106582 CVE record

CVSS 3.7 Low

OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…
- OpenBSD OpenSSH
- CWE-514
Not analysed yet 6 Oct 2026
CVE-2026-106555 CVE record

CVSS 2.2 Low

OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly…
- OpenBSD OpenSSH
- CWE-669
Not analysed yet 6 Oct 2026
CVE-2026-106553 CVE record

CVSS 2.2 Low

OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a…
- OpenBSD OpenSSH
- CWE-669
Not analysed yet 6 Oct 2026
CVE-2026-106552 CVE record

CVSS 4.2 Medium

Path traversal in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Path traversal
Not analysed yet 6 Oct 2026
CVE-2026-73283 CVE record

CVSS 2.5 Low

OpenBSD OpenSSH: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to…
- OpenBSD OpenSSH
- CWE-670
Not analysed yet 11 Aug 2026
CVE-2026-73282 CVE record

CVSS 4.8 Medium

Use after free in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Memory corruption
Not analysed yet 11 Aug 2026
CVE-2026-73281 CVE record

CVSS 3.5 Low

OpenBSD OpenSSH: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended…
- OpenBSD OpenSSH
- CWE-669
Not analysed yet 11 Aug 2026
CVE-2026-60002 CVE record

CVSS 7.7 High

Use after free in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Memory corruption
Not analysed yet 8 Jul 2026
CVE-2026-60001 CVE record

CVSS 6.5 Medium

Resource allocation without limits in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Denial of service
Not analysed yet 8 Jul 2026
CVE-2026-60000 CVE record

CVSS 3.7 Low

Resource allocation without limits in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Denial of service
Not analysed yet 8 Jul 2026
CVE-2026-59999 CVE record

CVSS 5.9 Medium

OpenBSD OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…
- OpenBSD OpenSSH
- CWE-348
Not analysed yet 8 Jul 2026
CVE-2026-59998 CVE record

CVSS 4.8 Medium

OpenBSD OpenSSH: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior…
- OpenBSD OpenSSH
- CWE-573
Not analysed yet 8 Jul 2026
CVE-2026-59997 CVE record

CVSS 4.2 Medium

OpenBSD OpenSSH: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line…
- OpenBSD OpenSSH
- CWE-1284
Not analysed yet 8 Jul 2026
CVE-2026-59996 CVE record

CVSS 4.2 Medium

Path traversal in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Path traversal
Not analysed yet 8 Jul 2026
CVE-2026-59995 CVE record

CVSS 4.2 Medium

Path traversal in OpenBSD OpenSSH
- OpenBSD OpenSSH
- Path traversal
Not analysed yet 8 Jul 2026
CVE-2026-35414 CVE record

CVSS 4.2 Medium

OpenBSD OpenSSH: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon…
- OpenBSD OpenSSH
- CWE-670
Not analysed yet 2 Apr 2026
CVE-2026-35388 CVE record

CVSS 2.5 Low

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
- OpenBSD OpenSSH
- CWE-420
Not analysed yet 2 Apr 2026
CVE-2026-35387 CVE record

CVSS 3.1 Low

OpenSSH before 10.3 can use unintended ECDSA algorithms.
- OpenBSD OpenSSH
- CWE-670
Not analysed yet 2 Apr 2026
CVE-2026-35386 CVE record

CVSS 3.6 Low

OpenBSD OpenSSH: In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…
- OpenBSD OpenSSH
- CWE-696
Not analysed yet 2 Apr 2026
CVE-2026-35385 CVE record

CVSS 7.5 High

OpenBSD OpenSSH: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid…
- OpenBSD OpenSSH
- CWE-281
Not analysed yet 2 Apr 2026
CVE-2025-61985 CVE record

CVSS 3.6 Low

OpenBSD OpenSSH: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI…
- OpenBSD OpenSSH
- CWE-158
Not analysed yet 6 Oct 2025
CVE-2025-61984 CVE record

CVSS 3.6 Low

OpenBSD OpenSSH: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from…
- OpenBSD OpenSSH
- CWE-159
Not analysed yet 6 Oct 2025
CVE-2025-32728 CVE record

CVSS 4.3 Medium

OpenBSD OpenSSH: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the…
- OpenBSD OpenSSH
- CWE-440
Not analysed yet 10 Apr 2025