tag
Ssh
FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718)
CVE-2025-59718 is an improper verification of a cryptographic signature in Fortinet's FortiCloud SSO admin-login flow across FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb, allowing authentication bypass when admin-forticloud-sso-login is enabled on a…
Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459)
The router's web management interface exposes a TR369Certificates CGI endpoint whose name parameter, used during a certificate "download" action, is passed unsanitized into a shell command executed as root. An authenticated administrator (or attacker with…
TP-Link Archer C64 Web UI Rate-Limit Bypass via Residual Debug SSH Service (CVE-2026-8697)
The TP-Link Archer C64 exposes a residual debug SSH service (port 22) that does not grant a shell — it simply closes the connection once a password is entered — but validates the password against the same credential used by the router's web admin interface,…
Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)
Termix's built-in File Manager renders SVG files opened from a connected host using dangerouslySetInnerHTML, without stripping active content such as <foreignObject>/<img onerror=...>. An attacker who can place a crafted SVG on a filesystem reachable via…
Cockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)
Cockpit's remote-login feature passes attacker-controlled hostnames (from the URL path) and usernames (from the Authorization: Basic header) directly to the OpenSSH ssh client without validation or a -- end-of-options separator. Because both values are used…
libssh2 Unchecked SSH packet_length Integer Wrap to RCE (CVE-2026-55200)
CVE-2026-55200 is an unchecked packetlength condition in libssh2's ssh2transportread() transport-parsing path. The vulnerable code accepts an attacker-controlled decrypted SSH packetlength field and only rejects values less than 1, then computes an allocation…
libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution
libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…
libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)
CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…
Erlang/OTP SSH Pre-Auth RCE - CVE-2025-32433
CVE-2025-32433 is a critical pre-authentication remote code execution vulnerability in the Erlang/OTP SSH server with a CVSS score of 10.0. An attacker with network access to any service built on Erlang/OTP's SSH daemon can execute arbitrary OS commands…