WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ssh✕
Overview 45 matches · 3 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
45matches 3in Waratek scope6.7% 1protected2.2% 1exploited2.2% 0CISA KEV0.0% 4public PoC8.9% 2EPSS ≥ 0.54.4%
Protected by Waratek 1 2.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 4.4% Outside Waratek scope 1 2.2% Not applicable 41 91.1% Withdrawn CVE 0 0.0%
Critical 45 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 2.2% partly blocked 0 0.0% not blocked 44 97.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 2.2% Working exploit published 2 4.4% Proof of concept only 5 11.1% Forecast only 0 0.0% No public exploit 37 82.2%
split by peak 10 / year
Not applicable: 41Outside Waratek scope: 1No exploit published: 2Protected by Waratek: 1 Critical: 45 not blocked: 44blocked by ARMR today: 1 No public exploit: 37Proof of concept only: 5Working exploit published: 2Exploited: 1
20022 Not applicable2 Critical2 not blocked2 Working exploit published1 No public exploit1 20030 20040 20050 20060 20070 20080 20090 20101 Not applicable1 Critical1 not blocked1 No public exploit1 20110 20120 20130 20140 20150 20161 Not applicable1 Critical1 not blocked1 No public exploit1 20174 No exploit published1 Not applicable3 Critical4 not blocked4 No public exploit4 20185 Outside Waratek scope1 Not applicable4 Critical5 not blocked5 Working exploit published1 No public exploit4 201910 Not applicable10 Critical10 not blocked10 No public exploit10 20202 Not applicable2 Critical2 not blocked2 No public exploit2 20212 Not applicable2 Critical2 not blocked2 No public exploit2 20223 Protected by Waratek1 Not applicable2 Critical3 blocked by ARMR today1 not blocked2 Proof of concept only2 No public exploit1 20233 Not applicable3 Critical3 not blocked3 Exploited1 Proof of concept only1 No public exploit1 20243 Not applicable3 Critical3 not blocked3 Proof of concept only1 No public exploit2 20254 No exploit published1 Not applicable3 Critical4 not blocked4 No public exploit4 20265 Not applicable5 Critical5 not blocked5 Proof of concept only1 No public exploit4
2002200420062008201020122014201620182020202220242026
45 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16516 Critical 2026-10-07 Not applicable No public exploit wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
CVE-2026-43798 Critical 2026-08-20 Not applicable No public exploit A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.
CVE-2026-60002 Critical 2026-07-08 Not applicable No public exploit ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
CVE-2026-55200 Critical 2026-06-17 Not applicable Proof of concept only libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
CVE-2025-14942 Critical 2026-01-06 Not applicable No public exploit wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier. Users of wolfSSH must update or apply the fix patch and it’s recommended to update credentials used. This fix is also recommended for wolfSSH server applications. While there aren’t any specific attacks on server applications, the same defect is present. Thanks to Aina Toky Rasoamanana of Valeo and Olivier Levillain of Telecom SudParis for the report.
CVE-2025-11625 Critical 2025-10-21 Not applicable No public exploit Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.
CVE-2025-4658 Critical 2025-05-13 Not applicable No public exploit Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
CVE-2025-32755 Critical 2025-04-10 Not applicable No public exploit In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
CVE-2025-32754 Critical 2025-04-10 No exploit published No public exploit In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
CVE-2024-2873 Critical 2024-03-25 Not applicable No public exploit A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.
CVE-2024-0417 Critical 2024-01-11 Not applicable Proof of concept only A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.
CVE-2024-0412 Critical 2024-01-11 Not applicable No public exploit A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.
CVE-2023-35861 Critical 2023-07-31 Not applicable Proof of concept only A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
CVE-2023-38408 Critical 2023-07-20 Not applicable Exploited The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
CVE-2023-28531 Critical 2023-03-17 Not applicable No public exploit ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVE-2022-46997 Critical 2022-12-14 Not applicable Proof of concept only Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-45047 Critical 2022-11-16 Protected by Waratek Proof of concept only Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
CVE-2022-32073 Critical 2022-07-13 Not applicable No public exploit WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR.
CVE-2020-26301 Critical 2021-09-20 Not applicable No public exploit ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
CVE-2021-21278 Critical 2021-01-26 Not applicable No public exploit RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.
CVE-2020-10654 Critical 2020-05-13 Not applicable No public exploit Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint.
CVE-2020-9355 Critical 2020-02-23 Not applicable No public exploit danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.
CVE-2019-16650 Critical 2019-09-21 Not applicable No public exploit On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
CVE-2019-16649 Critical 2019-09-21 Not applicable No public exploit On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.
CVE-2019-13923 Critical 2019-09-13 Not applicable No public exploit A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.
CVE-2019-3861 Critical 2019-03-25 Not applicable No public exploit An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3860 Critical 2019-03-25 Not applicable No public exploit An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3862 Critical 2019-03-21 Not applicable No public exploit An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3859 Critical 2019-03-21 Not applicable No public exploit An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3858 Critical 2019-03-21 Not applicable No public exploit An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3464 Critical 2019-02-06 Not applicable No public exploit Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
CVE-2019-3463 Critical 2019-02-06 Not applicable No public exploit Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
CVE-2018-10933 Critical 2018-10-17 Outside Waratek scope Working exploit published A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
CVE-2018-14441 Critical 2018-07-20 Not applicable No public exploit An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type.
CVE-2018-14440 Critical 2018-07-20 Not applicable No public exploit An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageAction_queryNotice.action noticeInfo parameter.
CVE-2018-9853 Critical 2018-07-10 Not applicable No public exploit Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server.
CVE-2018-7749 Critical 2018-03-12 Not applicable No public exploit The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
CVE-2017-1000245 Critical 2017-11-01 No exploit published No public exploit The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
CVE-2016-1908 Critical 2017-04-11 Not applicable No public exploit The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
CVE-2016-7407 Critical 2017-03-03 Not applicable No public exploit The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.
CVE-2016-7406 Critical 2017-03-03 Not applicable No public exploit Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
CVE-2016-4422 Critical 2016-05-06 Not applicable No public exploit The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
CVE-2010-4478 Critical 2010-12-06 Not applicable No public exploit OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
CVE-2002-0639 Critical 2002-07-03 Not applicable No public exploit Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
CVE-2002-0083 Critical 2002-03-15 Not applicable Working exploit published Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.