# cve.now: Termix-ssh

The newest entries naming Termix-ssh as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120322](https://cve.now/CVE-2026-120322.md): Termix-SSH Termix transferToHost path traversal (CVSS 9.4)
- [CVE-2026-79763](https://cve.now/CVE-2026-79763.md): Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749) (CVSS 5.3)
- [CVE-2026-79764](https://cve.now/CVE-2026-79764.md): Termix: Authenticated SSRF via \`/homepage/proxy\` — No Destination Allowlist (CVSS 7.7)
- [CVE-2026-79762](https://cve.now/CVE-2026-79762.md): Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy (CVSS 5.5)
- [CVE-2026-79766](https://cve.now/CVE-2026-79766.md): Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email (CVSS 9.1)
- [CVE-2026-79759](https://cve.now/CVE-2026-79759.md): Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint (CVSS 4.3)
- [CVE-2026-79761](https://cve.now/CVE-2026-79761.md): Termix: Command injection in SSH key deployment verification (CVSS 6.6)
- [CVE-2026-79758](https://cve.now/CVE-2026-79758.md): Termix: Authenticated users can read other users' host status and clear global SSH connections (CVSS 5.4)
- [CVE-2026-79760](https://cve.now/CVE-2026-79760.md): Termix: Authenticated blind SSRF through notification channel test endpoints (CVSS 6.4)
- [CVE-2026-53545](https://cve.now/CVE-2026-53545.md): Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection (CVSS 9.8)
- [CVE-2026-53546](https://cve.now/CVE-2026-53546.md): Termix: Missing authorization in SSH host credential resolution exposes stored credentials (CVSS 9.6)
- [CVE-2026-53542](https://cve.now/CVE-2026-53542.md): Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts (CVSS 8.8)
- [CVE-2026-53548](https://cve.now/CVE-2026-53548.md): Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users (CVSS 9.6)
- [CVE-2026-53547](https://cve.now/CVE-2026-53547.md): Termix: Account Takeover via Global Settings Disclosure (CVSS 8.8)
- [CVE-2026-53549](https://cve.now/CVE-2026-53549.md): Termix: Server-Side Request Forgery via Proxy Connectivity Test (CVSS 7.7)
- [CVE-2026-45750](https://cve.now/CVE-2026-45750.md): Termix Vulnerable to Arbitrary Command Execution in File Manager (CVSS 9.0)
- [CVE-2026-45749](https://cve.now/CVE-2026-45749.md): Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password (CVSS 8.1)
- [CVE-2026-45748](https://cve.now/CVE-2026-45748.md): Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection (CVSS 9.8)
- [CVE-2026-45746](https://cve.now/CVE-2026-45746.md): Termix Vulnerable to Arbitrary Command Execution via Session Hijacking (CVSS 9.0)
- [CVE-2026-45744](https://cve.now/CVE-2026-45744.md): Termix has an OS Command Injection in File Manager resolvePath endpoint (CVSS 9.9)
- [CVE-2026-45743](https://cve.now/CVE-2026-45743.md): Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) (CVSS 8.1)
- [CVE-2026-45745](https://cve.now/CVE-2026-45745.md): Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft (CVSS 8.0)
- [CVE-2026-42454](https://cve.now/CVE-2026-42454.md): Termix: OS Command Injection in Docker Container Management Endpoints (CVSS 9.9)
- [CVE-2026-42453](https://cve.now/CVE-2026-42453.md): Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass (CVSS 8.7)
- [CVE-2026-42452](https://cve.now/CVE-2026-42452.md): Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP (CVSS 8.1)
- [CVE-2026-22804](https://cve.now/CVE-2026-22804.md): Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/termix-ssh
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.