S
Vendor security profile
ssh
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs1
Critical0
CISA KEV0
Public exploit1
Patch rate%100
Avg. CVSS5.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
0
0
CVE KEV
CVE severity distribution
1toplam CVE
Medium1 (100%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%100
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
6.9
CVE-2026-84897
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
WI
Patch verifiedEPSS %0
5.3
CVE-2026-83742
wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
WI
Patch verifiedEPSS %0
7.7
CVE-2026-83540
wolfSSHd on Windows race condition leading to logon token reused across connections
W
Patch verifiedEPSS %0
6.3
CVE-2026-81535
wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
WI
Patch verifiedEPSS %0
9.0
CVE-2026-16516
wolfSSH ECDSA host key curve not validated against negotiated algorithm
WI
Patch verifiedEPSS %0
5.3
CVE-2026-79763
Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
T
Patch status unknownEPSS %0
7.7
CVE-2026-79764
Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist
T
Patch status unknownEPSS %0
5.5
CVE-2026-79762
Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy
T
Patch status unknownEPSS %0
9.1
CVE-2026-79766
Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email
T
Patch status unknownEPSS %0
4.3
CVE-2026-79759
Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint
T
Patch status unknownEPSS %0