CVE-2016-3115

openssh: missing sanitisation of input for X11 forwarding

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

CVSS 3.1 · 6.4 Medium EPSS 35.5% KEV · Not listed

Vendors

Openbsd Oracle Redhat

Products

Openssh Vm Server Enterprise Linux

CVE-2016-2183

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed

Vendors

Cisco Nodejs Openssl and 3 more

Products

Content Security Management Appliance Node.js Openssl and 11 more

CVE-2016-1908

openssh: possible fallback from untrusted to trusted X11 forwarding

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed

Vendors

Debian Openbsd Oracle and 1 more

Products

Debian Linux Openssh Linux and 7 more

CVE-2016-10012

openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support

The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2016-10011

openssh: Leak of host private key material to privilege-separated child process via realloc()

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2016-10010

openssh: privilege escalation via Unix domain socket forwarding

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.

CVSS 3.1 · 7 High EPSS 4.2% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2016-10009

openssh: loading of untrusted PKCS#11 modules in ssh-agent

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVSS 3.1 · 7.3 High EPSS 37.4% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2016-0778

OpenSSH: Client buffer-overflow when using roaming connections

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

CVSS 3.1 · 8.1 High EPSS 20.9% KEV · Not listed

Vendors

Apple Hp Openbsd and 3 more

Products

Mac Os X Virtual Customer Access System Openssh and 4 more

CVE-2016-0777

OpenSSH: Client Information leak due to use of roaming connection feature

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

CVSS 3.1 · 6.5 Medium EPSS 63.5% KEV · Not listed

Vendors

Apple Hp Openbsd and 3 more

Products

Mac Os X Remote Device Access Virtual Customer Access System Openssh and 5 more

CVE-2011-4327

openssh: Unauthorized local access to host keys on platforms where ssh-rand-helper used

ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2011-0539

OpenSSH: legacy certificate generation information leak

The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2010-5107

openssh: Prevent connection slot exhaustion attacks

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

CVSS 3.1 · 7.5 High EPSS 16.9% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2020-8927

Buffer overflow in Brotli library

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVSS 3.1 · 5.3 Medium EPSS 3.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 9 more

CVE-2026-46824

Low-privilege HTTP takeover of Oracle Universal Work Queue

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Universal Work Queue

CVE-2026-10067

Shibby Tomato multimon.cgi sub_90F0 stack-based overflow

A vulnerability was detected in Shibby Tomato 1.28. Impacted is the function sub_90F0 of the file multimon.cgi. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Shibby

Products

Tomato

CVE-2026-35673

OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by reusing blocked tabs to export or inspect content that should remain protected.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-9959

chromium-browser: Race in WebRTC

Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2018-25395

Kados R10 GreenBee SQL Injection via update_feature.php

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kados

Products

Kados R10 Greenbee

CVE-2026-9961

chromium-browser: Use after free in SurfaceCapture

Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-9964

chromium-browser: Use after free in Bluetooth

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome