E
Vendor security profile
Eugeny
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical0
CISA KEV0
Public exploit9
Patch rate%36
Avg. CVSS5.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
5
6
0
CVE KEV
CVE severity distribution
11toplam CVE
High2 (18%)
Medium7 (64%)
Low2 (18%)
Patch and exploitation view
%36
Verified patch
%0
CISA KEV
%82
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
3.7
CVE-2026-102825
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
E
Patch status unknownEPSS %0
4.3
CVE-2026-102824
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
E
Patch status unknownEPSS %0
7.5
CVE-2026-102823
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
E
Patch status unknownEPSS %0
3.7
CVE-2026-102822
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
E
Patch status unknownEPSS %0
6.5
CVE-2026-102821
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
E
Patch status unknownEPSS %0
6.2
CVE-2026-102820
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
E
Patch status unknownEPSS %0
4.3
CVE-2026-73489
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
E
Patch verifiedEPSS %0
5.3
CVE-2026-73430
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
E
Patch verifiedEPSS %1
5.3
CVE-2026-73429
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
E
Patch verifiedEPSS %1
8.1
CVE-2026-72903
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
E
Patch status unknownEPSS %0