EEugeny

Products

Exploited and recent CVEs

• CVE-2026-111062 Low 2.3 A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request 0.4%
• CVE-2026-116794 High 8.3 russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation 0.2%
• CVE-2026-116775 Low 2.3 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) 0.3%
• CVE-2026-116774 Medium 4.3 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) 0.3%
• CVE-2026-116773 Medium 4.3 russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets 0.3%
• CVE-2026-116696 Low 3.3 russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages 0.1%
• CVE-2026-111061 Medium 4.3 russh agent server converts constraint records into unbounded never-rolled-back tasks 0.3%
• CVE-2026-102825 Low 3.7 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path 0.4%
• CVE-2026-102824 Medium 4.3 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange 0.1%
• CVE-2026-102823 High 7.5 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened 0.3%
• CVE-2026-102822 Low 3.7 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic 0.3%
• CVE-2026-102821 Medium 6.5 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey 0.4%
• CVE-2026-102820 Medium 6.2 pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows) 0.2%
• CVE-2026-73489 Medium 4.3 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records 0.5%
• CVE-2026-73430 Medium 5.3 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) 0.6%
• CVE-2026-73429 Medium 5.3 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) 0.5%
• CVE-2026-72903 High 8.1 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory 0.5%
• CVE-2026-68930 Medium 6.5 Russh: Channel-scoped server callbacks can be reached without an open channel 0.4%
• CVE-2026-46709 High 7.8 Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) 0.3%
• CVE-2026-48110 High 7.5 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds 0.4%
• CVE-2026-48108 Medium 5.3 Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input 0.3%
• CVE-2026-48107 Medium 6.5 Russh: Unchecked keyboard-interactive prompt count in client auth path 0.2%
• CVE-2026-46705 Medium 5.3 russh server userauth state is not reset when authentication principal changes 0.2%
• CVE-2026-46702 High 7.5 Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets 0.3%
• CVE-2026-46673 High 7.5 Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases 0.3%
• CVE-2026-45038 High 8.4 Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution 0.2%
• CVE-2026-45036 High 7.0 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh 0.1%
• CVE-2026-45035 Critical 9.4 Tabby: RCE via `tabby://run` URL Scheme 0.4%
• CVE-2026-45037 High 7.1 Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation 0.1%
• CVE-2026-42189 High 7.5 Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth 0.5%