Known vulnerabilities in openssh
Vendor:
Fedoraproject
Software:
openssh
Software CPE:
cpe:2.3:o:fedoraproject:openssh:*:*:*:*:*:fedora:*:*
Website:
https://getfedora.org/
Total vulnerabilities:
35
Public exploits:
11
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.4
Breakdown by Severity Chart
10.2p1-13.fc44
10.0p1-11.fc43
10.2p1-12.fc44
10.0p1-10.fc43
10.3p1-4.fc45
9.9p1-14.fc42
10.2p1-8.fc44
10.0p1-9.fc43
10.2p1-6.fc44
9.9p1-13.fc42
10.0p1-7.fc43
9.9p1-11.fc42
9.9p1-4.fc41
8.0p1-1.fc30
7.8p1-4.fc28
7.9p1-3.fc29
7.6p1-6.fc27
7.8p1-1.fc28
7.4p1-5.fc25
7.5p1-4.fc26
7.6p1-2.fc27
7.4p1-1.fc25
7.2p2-6.fc23
7.2p2-13.fc24
7.3p1-4.fc25
7.2p2-12.fc24
7.2p2-5.fc23
7.2p2-4.fc23
7.2p2-10.fc24
7.2p2-3.fc23
7.2p2-5.fc24
7.2p2-1.fc24
6.9p1-11.fc22
7.2p2-1.fc23
6.9p1-10.fc22
7.1p2-1.fc23
6.6.1p1-16.fc21
6.9p1-5.fc22
7.0p1-1.fc23
6.6.1p1-15.fc21
6.9p1-4.fc22
6.6.1p1-14.fc21
6.9p1-3.fc22
6.6.1p1-13.fc21
6.9p1-1.fc22
9.0p1-19.fc38
9.6p1-2.fc40
9.9p1-3.fc41
8.4p1-8.fc33
8.6p1-5.fc34
8.7p1-2.fc35
8.4p1-7.fc33
8.5p1-2.fc34
9.6p1-1.fc40.4
9.3p1-11.fc39
9.3p1-10.fc39
9.0p1-18.fc38
9.0p1-16.fc38
8.8p1-11.fc37
8.8p1-10.fc37
9.0p1-15.fc38
Vulnerabilities (35)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU137699 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-59996 |
CWE-22 | Medium | 10.0p1-11.fc43, 10.2p1-13.fc44 | 15.07.2026 |
SB2026071535 SB20260715100 SB2026071797 and 7 more |
||
| #VU137704 - Use After Free CVE-2026-60002 |
CWE-416 | Low | 10.0p1-11.fc43, 10.2p1-13.fc44 | 15.07.2026 |
SB2026071535 SB20260715100 SB2026071797 and 8 more |
||
| #VU128473 - Improper input validation CVE-2026-35386 |
CWE-20 | Low | 10.0p1-9.fc43, 10.2p1-8.fc44 | 29.04.2026 |
SB2026042988 SB2026042990 SB2026042992 and 16 more |
||
| #VU128474 - Improper Access Control CVE-2026-35414 |
CWE-284 | Low | 10.0p1-9.fc43, 10.2p1-8.fc44 | 29.04.2026 |
SB2026042988 SB2026042990 SB2026042992 and 24 more |
||
| #VU128475 - Improper Privilege Management CVE-2026-35385 |
CWE-269 | Low | 9.9p1-14.fc42, 10.0p1-9.fc43, 10.2p1-8.fc44 | 29.04.2026 |
SB2026042988 SB2026042990 SB2026042992 and 30 more |
||
| #VU128476 - Improper Access Control CVE-2026-35387 |
CWE-284 | Low | 10.0p1-9.fc43, 10.2p1-8.fc44 | 29.04.2026 |
SB2026042988 SB2026042990 SB2026042992 and 17 more |
||
| #VU128477 - Improper Authorization CVE-2026-35388 |
CWE-285 | Low | 10.0p1-9.fc43, 10.2p1-8.fc44 | 29.04.2026 |
SB2026042988 SB2026042990 SB2026042992 and 19 more |
||
| #VU124014 - Resource Management Errors CVE-2026-3497 |
CWE-399 | Low | 9.9p1-13.fc42, 10.0p1-7.fc43, 10.2p1-6.fc44 | 13.03.2026 |
SB2026031837 SB2026031838 SB2026031839 and 19 more |
||
| #VU107332 - Protection Mechanism Failure CVE-2025-32728 |
CWE-693 | Low | 9.9p1-4.fc41, 9.9p1-11.fc42 | 10.04.2025 |
SB2025041009 SB2025041010 SB2025042478 and 14 more |
||
| #VU104035 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle') CVE-2025-26465 |
CWE-300 | Medium | 9.6p1-2.fc40, 9.9p1-3.fc41 | 18.02.2025 |
SB2025021815 SB2025021830 SB2025021833 and 49 more |
||
| #VU104034 - Improper input validation CVE-2025-26466 |
CWE-20 | Medium | 9.6p1-2.fc40, 9.9p1-3.fc41 | 18.02.2025 |
SB2025021815 SB2025021830 SB2025021840 and 25 more |
||
| #VU93513 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CVE-2024-6387 |
CWE-362 | High | 9.3p1-11.fc39, 9.6p1-1.fc40.4 | 01.07.2024 |
SB2024070144 SB2024070145 SB2024070152 and 89 more |
||
| #VU78454 - Untrusted Search Path CVE-2023-38408 |
CWE-426 | Medium | 8.8p1-11.fc37, 9.0p1-16.fc38 | 20.07.2023 |
SB2023072068 SB2023072073 SB2023072074 and 73 more |
||
| #VU73775 - Credentials Management CVE-2023-28531 |
CWE-255 | Low | 9.0p1-19.fc38 | 17.03.2023 |
SB2023031706 SB2023031713 SB2023062110 and 5 more |
||
| #VU71771 - Double Free CVE-2023-25136 |
CWE-415 | High | 8.8p1-10.fc37, 9.0p1-15.fc38 | 02.02.2023 |
SB2023020247 SB2023020304 SB2023021660 and 11 more |
||
| #VU58333 - Improper Privilege Management CVE-2021-41617 |
CWE-269 | Low | 8.4p1-8.fc33, 8.6p1-5.fc34, 8.7p1-2.fc35 | 23.11.2021 |
SB2021092601 SB2021112330 SB2021120119 and 38 more |
||
| #VU51444 - Double Free CVE-2021-28041 |
CWE-415 | Medium | 8.4p1-7.fc33, 8.5p1-2.fc34 | 14.03.2021 |
SB2021031404 SB2021031405 SB2021052625 and 9 more |
||
| #VU16990 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing) CVE-2019-6109 |
CWE-451 | Low | 8.0p1-1.fc30 | 15.01.2019 |
SB2019011505 SB2019012805 SB2019012904 and 13 more |
||
| #VU16988 - Improper input validation CVE-2019-6111 |
CWE-20 | Low | 8.0p1-1.fc30 | 15.01.2019 |
SB2019011505 SB2019012805 SB2019012904 and 17 more |
||
| #VU16946 - Improper Access Control CVE-2018-20685 |
CWE-284 | Low | 7.8p1-4.fc28, 7.9p1-3.fc29 | 10.01.2019 |
SB2019011505 SB2019012805 SB2019012904 and 14 more |
Showing elements 1 - 20 out of 35