{"history":[{"alert":0,"cve":"CVE-2026-123158","id":23251,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.189, \"percentile\": 0.97335}"},{"alert":1,"cve":"CVE-2026-123158","id":20969,"kind":"cna","observed_at":1794349204,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2026-11-10T00:11:05.950Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/\"}, {\"url\": \"https://news.ycombinator.com/item?id=50379704\"}, {\"url\": \"https://github.com/google/goonami-scanner/pull/277\"}, {\"url\": \"https://github.com/coollabsio/coolify/discussions/12484\"}, {\"url\": \"https://github.com/panubo/docker-sshd/issues/93\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/11/09/27\"}], \"title\": \"CVE Program Container\", \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-123158\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-05T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-11-09\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T04:55:54.758Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"exploit\", \"technical-description\"], \"url\": \"https://sshhole.com\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://sshole.events.greynoise.io/\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://isc.sans.edu/diary.html?storyid=33498\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-11-09T00:00:00.000Z\", \"value\": \"CVE-2026-123158 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"platforms\": [\"Linux\"], \"product\": \"OpenSSH\", \"vendor\": \"OpenBSD\", \"versions\": [{\"lessThan\": \"10.6p2\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.6p2\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-394\", \"description\": \"CWE-394 Unexpected Status Code or Return Value\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-05T15:46:26.488Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"url\": \"https://www.openssh.org/releasenotes.html#10.6p2\"}, {\"url\": \"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482\"}, {\"url\": \"https://news.ycombinator.com/item?id=50377976\"}, {\"url\": \"https://news.ycombinator.com/item?id=50378228\"}, {\"url\": \"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2\"}, {\"url\": \"https://hachyderm.io/@damienmiller/117563026759098135\"}, {\"url\": \"https://github.com/predkambrij/sshhole-repro\"}, {\"url\": \"https://github.com/leonjza/sshhole-lab\"}], \"x_generator\": {\"engine\": \"CVE-Request-form 0.0.1\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2026-123158\", \"datePublished\": \"2026-11-05T15:46:26.488Z\", \"dateReserved\": \"2026-11-05T15:46:25.881Z\", \"dateUpdated\": \"2026-11-10T04:55:54.758Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-123158","id":20716,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.16501, \"percentile\": 0.97016}"},{"alert":0,"cve":"CVE-2026-123158","id":18871,"kind":"epss","observed_at":1794262800,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.01014, \"percentile\": 0.63482}"},{"alert":1,"cve":"CVE-2026-123158","id":18868,"kind":"cna","observed_at":1794262800,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2026-11-08T02:55:48.643Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/\"}, {\"url\": \"https://news.ycombinator.com/item?id=50379704\"}, {\"url\": \"https://github.com/google/goonami-scanner/pull/277\"}, {\"url\": \"https://github.com/coollabsio/coolify/discussions/12484\"}, {\"url\": \"https://github.com/panubo/docker-sshd/issues/93\"}], \"title\": \"CVE Program Container\", \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-123158\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-09T16:50:17.920404Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-11-09\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-09T20:58:24.060Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"exploit\", \"technical-description\"], \"url\": \"https://sshhole.com\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://sshole.events.greynoise.io/\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://isc.sans.edu/diary.html?storyid=33498\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-11-09T00:00:00.000Z\", \"value\": \"CVE-2026-123158 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"platforms\": [\"Linux\"], \"product\": \"OpenSSH\", \"vendor\": \"OpenBSD\", \"versions\": [{\"lessThan\": \"10.6p2\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.6p2\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-394\", \"description\": \"CWE-394 Unexpected Status Code or Return Value\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-05T15:46:26.488Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"url\": \"https://www.openssh.org/releasenotes.html#10.6p2\"}, {\"url\": \"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482\"}, {\"url\": \"https://news.ycombinator.com/item?id=50377976\"}, {\"url\": \"https://news.ycombinator.com/item?id=50378228\"}, {\"url\": \"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2\"}, {\"url\": \"https://hachyderm.io/@damienmiller/117563026759098135\"}, {\"url\": \"https://github.com/predkambrij/sshhole-repro\"}, {\"url\": \"https://github.com/leonjza/sshhole-lab\"}], \"x_generator\": {\"engine\": \"CVE-Request-form 0.0.1\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2026-123158\", \"datePublished\": \"2026-11-05T15:46:26.488Z\", \"dateReserved\": \"2026-11-05T15:46:25.881Z\", \"dateUpdated\": \"2026-11-09T20:58:24.060Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-123158","id":18866,"kind":"kev","observed_at":1794262800,"payload":"{\"cveID\": \"CVE-2026-123158\", \"cwes\": [\"CWE-394\"], \"dateAdded\": \"2026-11-09\", \"dueDate\": \"2026-11-12\", \"forensicTriage\": \"Yes\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.openssh.org/releasenotes.html ; https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ ; https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123158\", \"product\": \"OpenSSH\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.\", \"vendorProject\": \"OpenBSD\", \"vulnerabilityName\": \"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OpenSSH","vendor":"OpenBSD","versions":[{"lessThan":"10.6p2","status":"affected","version":"0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-10T00:11:05.950Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"url":"https://news.ycombinator.com/item?id=50379704"},{"url":"https://github.com/google/goonami-scanner/pull/277"},{"url":"https://github.com/coollabsio/coolify/discussions/12484"},{"url":"https://github.com/panubo/docker-sshd/issues/93"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/27"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}},{"metrics":[{"other":{"content":{"id":"CVE-2026-123158","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-11-09","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-11-10T04:55:54.758Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit","technical-description"],"url":"https://sshhole.com"},{"tags":["third-party-advisory"],"url":"https://sshole.events.greynoise.io/"},{"tags":["third-party-advisory"],"url":"https://isc.sans.edu/diary.html?storyid=33498"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158"}],"timeline":[{"lang":"en","time":"2026-11-09T00:00:00.000Z","value":"CVE-2026-123158 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OpenSSH","vendor":"OpenBSD","versions":[{"lessThan":"10.6p2","status":"affected","version":"0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6p2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-394","description":"CWE-394 Unexpected Status Code or Return Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T15:46:26.488Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6p2"},{"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"},{"url":"https://news.ycombinator.com/item?id=50377976"},{"url":"https://news.ycombinator.com/item?id=50378228"},{"url":"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2"},{"url":"https://hachyderm.io/@damienmiller/117563026759098135"},{"url":"https://github.com/predkambrij/sshhole-repro"},{"url":"https://github.com/leonjza/sshhole-lab"}],"x_generator":{"engine":"CVE-Request-form 0.0.1"}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2026-123158","datePublished":"2026-11-05T15:46:26.488Z","dateReserved":"2026-11-05T15:46:25.881Z","dateUpdated":"2026-11-10T04:55:54.758Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794457201,"cve":"CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","epss":{"date":"2026-11-12","epss":0.189,"percentile":0.97335},"epss_checked":1794522003,"first_seen":1794262800,"kev":{"cveID":"CVE-2026-123158","cwes":["CWE-394"],"dateAdded":"2026-11-09","dueDate":"2026-11-12","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.openssh.org/releasenotes.html ; https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ ; https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123158","product":"OpenSSH","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.","vendorProject":"OpenBSD","vulnerabilityName":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability"},"kev_checked":1794522003,"products":"OpenBSD OpenSSH","references":["https://www.openssh.org/releasenotes.html#10.6p2","https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482","https://news.ycombinator.com/item?id=50377976","https://news.ycombinator.com/item?id=50378228","https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2","https://hachyderm.io/@damienmiller/117563026759098135","https://github.com/predkambrij/sshhole-repro","https://github.com/leonjza/sshhole-lab","https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","https://news.ycombinator.com/item?id=50379704","https://github.com/google/goonami-scanner/pull/277","https://github.com/coollabsio/coolify/discussions/12484","https://github.com/panubo/docker-sshd/issues/93","http://www.openwall.com/lists/oss-security/2026/11/09/27","https://sshhole.com","https://sshole.events.greynoise.io/","https://isc.sans.edu/diary.html?storyid=33498","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"mitre","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158","id":249,"publisher":"CISA KEV","title":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability"},{"canonical_url":"https://xakep.ru/2026/11/10/sshole-attacks/","id":405,"publisher":"Xakep","title":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SSHole \u0443\u0436\u0435 \u0432\u0437\u044f\u043b\u0438 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b"},{"canonical_url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/","id":375,"publisher":"BleepingComputer","title":"Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day"},{"canonical_url":"https://securityaffairs.com/202813/hacking/u-s-cisa-adds-ibm-signalwire-freeswitch-openssh-and-gpustack-flaws-to-its-known-exploited-vulnerabilities-catalog.html","id":363,"publisher":"Security Affairs","title":"U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog"},{"canonical_url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","id":299,"publisher":"BleepingComputer","title":"Hackers exploit SSHole OpenSSH flaw to breach Linux systems"}]}