最近六个月的全部 CVE，每天更新。

显示 9 条中的 9 条

• 严重CVE-2026-89422CVSS 评分 9.32026年9月22日

  Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client

  CWE-322
• 中CVE-2026-18654CVSS 评分 6.82026年8月3日

  Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the clie

  CWE-322
• 高CVE-2026-58065CVSS 评分 8.12026年7月13日

  The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the se

  CWE-322apache apache-airflow-providers-git
• 高CVE-2026-11745CVSS 评分 8.82026年6月22日

  A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and c

  CWE-322
• 高CVE-2026-45361CVSS 评分 8.12026年5月25日

  Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advis

  CWE-322apache apache-airflow-providers-google
• 中CVE-2026-44467CVSS 评分 6.82026年5月13日

  The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known

  CWE-297CWE-322anthropic claude_desktop
• 中CVE-2026-1354CVSS 评分 6.42026年4月21日

  Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the mo

  CWE-322
• 高CVE-2025-13914CVSS 评分 8.72026年4月9日

  A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machin

  CWE-322juniper apstra
• 高CVE-2026-33697CVSS 评分 7.52026年3月27日

  Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel TD

  CWE-322CWE-346ultraviolet cocos_ai