Threat database

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

CVE-2026-35414 is a medium severity vulnerability in OpenSSH versions prior to 10.3. It involves an always-incorrect control flow implementation (CWE-670) related to the mishandling of the authorized_keys principals option in uncommon scenarios where a principals list is combined with a Certificate Authority that uses comma characters. This flaw may lead to limited confidentiality and integrity impacts but does not affect availability. There are no known exploits in the wild, and no official patch or vendor advisory is currently available.

CVE-2026-35388 is a low-severity vulnerability in OpenSSH versions before 10.3 where connection multiplexing confirmation is omitted for proxy-mode multiplexing sessions. This issue relates to CWE-420, an unprotected alternate channel, potentially allowing limited unauthorized interaction. The vulnerability does not impact confidentiality or availability but may cause limited integrity issues. There are no known exploits in the wild, and no official patch or vendor advisory is currently provided.

OpenSSH versions before 10.3 have a vulnerability where specifying any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms causes all ECDSA algorithms to be accepted. This is due to incorrect control flow implementation. The issue is classified under CWE-670 and has a low CVSS score of 3.1.

CVE-2026-35386 is a low-severity vulnerability in OpenSSH versions before 10.3 where command execution can occur due to improper handling of shell metacharacters in usernames on the command line. Exploitation requires an untrusted username input and non-default ssh_config settings involving the % character. The vulnerability has a CVSS score of 3.6 and does not have known exploits in the wild. No official patch or remediation details are provided in the available data.

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

CVE-2020-7247 is a high-severity remote code execution vulnerability in OpenSMTPD's smtp_mailaddr function. It allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.