CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

OpenSSH — security advisories

18 advisorieslatest 2026-07-10⚡ RSS feed

Tracked OpenSSH products:

OpenSSH sshd scp ssh

⚡ Watch OpenSSH

Get an email when a new OpenSSH advisory drops — max one per day, one-click unsubscribe.

[NEW] [medium] OpenSSH: Multiple vulnerabilities

mediumcert-bund2026-07-10

[UPDATE] [medium] OpenSSH: Multiple vulnerabilities

mediumCVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388cert-bund2026-07-09

[UPDATE] [medium] OpenSSH: Multiple vulnerabilities

mediumCVE-2026-55653 CVE-2026-55654 CVE-2026-55655cert-bund2026-07-08

USN-8514-1: OpenSSH vulnerability

unknownCVE-2026-35385ubuntu2026-07-06

OpenSSH security advisory (AV26-658)

unknowncccs2026-07-06

Multiple vulnerabilities in OpenSSH (July 6, 2026)

unknowncert-fr-avis2026-07-06

[UPDATE] [medium] OpenSSH GSSAPI delta: Vulnerability allows unspecified attack

mediumCVE-2026-3497cert-bund2026-07-02

CVE-2026-59998: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

mediumCVSS 4.8CVE-2026-59998msrc2026-07-02

CVE-2026-59997: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

mediumCVSS 4.2CVE-2026-59997msrc2026-07-02

CVE-2026-59995: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

mediumCVSS 4.2CVE-2026-59995msrc2026-07-02

CVE-2026-59999: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

mediumCVSS 5.9CVE-2026-59999msrc2026-07-02

CVE-2026-60001: sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

mediumCVSS 6.5CVE-2026-60001msrc2026-07-02

CVE-2026-60000: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

lowCVSS 3.7CVE-2026-60000msrc2026-07-02

CVE-2026-59996: scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

mediumCVSS 4.2CVE-2026-59996msrc2026-07-02

CVE-2026-60002: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

highCVSS 7.7CVE-2026-60002msrc2026-07-02

CVE-2026-55653: Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

mediumCVSS 4.3CVE-2026-55653msrc2026-06-09

Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466

unknownCVE-2025-26466fortinet2025-03-11

Vulnerability in OpenSSH (July 1, 2024)

unknownCVE-2024-6387cert-fr-alerte2024-07-01