CVE Tools
Track your stack

Ssh

32 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Ssh, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Ssh CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Ssh CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-111
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100
2026-110

Severity

How the 32 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical39%
  • High1650%
  • Medium1134%
  • Low26%

Latest CVEs

The 15 most recently published vulnerabilities affecting Ssh.

  1. CVE-2025-47913Potential denial of service in golang.org/x/crypto/ssh/agent7.5
  2. CVE-2025-22869Potential denial of service in golang.org/x/crypto7.5
  3. CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (fr...5.9
  4. CVE-2021-43565The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.7.5
  5. CVE-2022-30959A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials ...6.5
  6. CVE-2022-30958A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs ob...8.8
  7. CVE-2022-30957A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.4.3
  8. CVE-2022-27191The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.7.5
  9. CVE-2020-29652A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.7.5
  10. CVE-2017-1000245The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.9.8
  11. CVE-2011-0766The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, wh...7.8
  12. CVE-2002-1715SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script t...7.2
  13. CVE-2001-1474SSH before 2.0 disables host key checking when connecting to the localhost, which allows remote attackers to silently redirect connections to the localhost by poisoning the client's DNS cache.5.0
  14. CVE-2001-1475SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is generated.7.5
  15. CVE-2001-1470The IDEA cipher as implemented by SSH1 does not protect the final block of a message against modification, which allows remote attackers to modify the block without detection by changing its cyclic...5.0

Product grouping is registry-driven, with AI assist and human review. How it works