CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 26, 2026, 4:40 AM ET)

What this means for you

This week: 4,062 CVEs published, 331 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 4,062; Show in the list
Critical, last 7 days: 331; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,756; Show in the list

Showing CVEs that name the product libssh2:libssh2. Show all products

22 CVEs, showing 1 to 22

CVE	Severity	Title	Published
CVE-2026-66035	High 7.5	libssh2 Heap Buffer Overflow via ETM Cipher Negotiation Assigned by VulnCheck	Jul 24, 2026
CVE-2026-66034	High 7.5	libssh2 Heap Out-of-Bounds Read via publickey subsystem Assigned by VulnCheck	Jul 24, 2026
CVE-2026-66033	High 7.5	libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation Assigned by VulnCheck	Jul 24, 2026
CVE-2026-66032	High 8.8	libssh2 Double-Free Heap Corruption via sftp_open() Assigned by VulnCheck	Jul 24, 2026
CVE-2026-58051	Medium 6.5	libssh2 - Free of Uninitialized Pointer in publickey List Cleanup Assigned by VulnCheck	Jun 27, 2026
CVE-2026-58050	High 7.0	libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation Assigned by VulnCheck	Jun 27, 2026
CVE-2025-15661	Medium 6.5	libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c Assigned by VulnCheck	Jun 18, 2026
CVE-2026-55200	High 8.1	libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c Assigned by VulnCheck	Jun 17, 2026
CVE-2026-55199	Medium 5.9	libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler Assigned by VulnCheck	Jun 17, 2026
CVE-2026-7598	High 7.3	libssh2 userauth.c userauth_password integer overflow Assigned by VulDB	May 1, 2026
CVE-2023-48795	Medium 5.9	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from… Assigned by mitre	Dec 17, 2023
CVE-2020-22218	High 7.5	An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory. Assigned by mitre	Aug 21, 2023
CVE-2019-17498	High 8.1	In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a s… Assigned by mitre	Oct 20, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3860	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3861	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3863	High 7.5	A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. Assigned by redhat	Mar 25, 2019
CVE-2019-3858	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-3862	High 7.3	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. Assigned by redhat	Mar 20, 2019
CVE-2019-3859	Medium 5.0	An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. Assigned by redhat	Mar 20, 2019

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.