# cve.now: Eugeny

The newest entries naming Eugeny as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111062](https://cve.now/CVE-2026-111062.md): A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request (CVSS 2.3)
- [CVE-2026-116794](https://cve.now/CVE-2026-116794.md): russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation (CVSS 8.3)
- [CVE-2026-116775](https://cve.now/CVE-2026-116775.md): pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) (CVSS 2.3)
- [CVE-2026-116774](https://cve.now/CVE-2026-116774.md): russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) (CVSS 4.3)
- [CVE-2026-116773](https://cve.now/CVE-2026-116773.md): russh's SSH client is susceptible to unbounded allocations via EXT\_INFO packets (CVSS 4.3)
- [CVE-2026-116696](https://cve.now/CVE-2026-116696.md): russh's SSH agent server is susceptible to unbound allocations via repeated SSH\_AGENT\_CONSTRAIN\_CONFIRM messages (CVSS 3.3)
- [CVE-2026-111061](https://cve.now/CVE-2026-111061.md): russh agent server converts constraint records into unbounded never-rolled-back tasks (CVSS 4.3)
- [CVE-2026-102825](https://cve.now/CVE-2026-102825.md): Russh: Configured server auth-attempt cap is not enforced in the USERAUTH\_REQUEST runtime path (CVSS 3.7)
- [CVE-2026-102824](https://cve.now/CVE-2026-102824.md): Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange (CVSS 4.3)
- [CVE-2026-102823](https://cve.now/CVE-2026-102823.md): russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened (CVSS 7.5)
- [CVE-2026-102822](https://cve.now/CVE-2026-102822.md): russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic (CVSS 3.7)
- [CVE-2026-102821](https://cve.now/CVE-2026-102821.md): Russh: Unbounded memory exhaustion via CHANNEL\_OPEN flood during a client-stalled rekey (CVSS 6.5)
- [CVE-2026-102820](https://cve.now/CVE-2026-102820.md): pageant: Out-of-bounds read / oversized allocation in \`pageant\` MemoryMap::read via a malicious Pageant agent (Windows) (CVSS 6.2)
- [CVE-2026-73489](https://cve.now/CVE-2026-73489.md): Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records (CVSS 4.3)
- [CVE-2026-73430](https://cve.now/CVE-2026-73430.md): Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode\_mpint OOB) (CVSS 5.3)
- [CVE-2026-73429](https://cve.now/CVE-2026-73429.md): Russh: client wrong-length X25519 \`clone\_from\_slice\` panic (pre-auth DoS) (CVSS 5.3)
- [CVE-2026-72903](https://cve.now/CVE-2026-72903.md): Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory (CVSS 8.1)
- [CVE-2026-68930](https://cve.now/CVE-2026-68930.md): Russh: Channel-scoped server callbacks can be reached without an open channel (CVSS 6.5)
- [CVE-2026-46709](https://cve.now/CVE-2026-46709.md): Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) (CVSS 7.8)
- [CVE-2026-48110](https://cve.now/CVE-2026-48110.md): Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds (CVSS 7.5)
- [CVE-2026-48108](https://cve.now/CVE-2026-48108.md): Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input (CVSS 5.3)
- [CVE-2026-48107](https://cve.now/CVE-2026-48107.md): Russh: Unchecked keyboard-interactive prompt count in client auth path (CVSS 6.5)
- [CVE-2026-46705](https://cve.now/CVE-2026-46705.md): russh server userauth state is not reset when authentication principal changes (CVSS 5.3)
- [CVE-2026-46702](https://cve.now/CVE-2026-46702.md): Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets (CVSS 7.5)
- [CVE-2026-46673](https://cve.now/CVE-2026-46673.md): Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases (CVSS 7.5)
- [CVE-2026-45038](https://cve.now/CVE-2026-45038.md): Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution (CVSS 8.4)
- [CVE-2026-45036](https://cve.now/CVE-2026-45036.md): Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh (CVSS 7.0)
- [CVE-2026-45035](https://cve.now/CVE-2026-45035.md): Tabby: RCE via \`tabby://run\` URL Scheme (CVSS 9.4)
- [CVE-2026-45037](https://cve.now/CVE-2026-45037.md): Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation (CVSS 7.1)
- [CVE-2026-42189](https://cve.now/CVE-2026-42189.md): Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth (CVSS 7.5)
- [CVE-2025-54804](https://cve.now/CVE-2025-54804.md): Russh is missing an overflow check during channel windows adjust (CVSS 6.5)
- [CVE-2025-22136](https://cve.now/CVE-2025-22136.md): Tabby has a TCC Bypass via Misconfigured Node Fuses (CVSS 8.6)
- [CVE-2024-55950](https://cve.now/CVE-2024-55950.md): Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby (CVSS 8.6)
- [CVE-2024-43410](https://cve.now/CVE-2024-43410.md): Russh has an OOM Denial of Service due to allocation of untrusted amount (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/eugeny
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.