Vulnerabilidades em Eugeny
34 resultadosAnálise Vexday
Eugeny acumula 16 vulnerabilidades na base, com preocupação significativa: 12 foram publicadas nos últimos 90 dias, indicando exposição recente e acelerada. Apesar de nenhuma estar sob ataque ativo identificado no momento, a vulnerabilidade crítica registrada e o padrão dominante de gestão inadequada de recursos (CWE-770) requerem atenção imediata para avaliação de risco e mitigação.
CVE-2026-46702HIGHRussh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetsEPSS 0.3%CVE-2026-46673HIGHRussh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releasesEPSS 0.3%CVE-2026-116774MEDIUMrussh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)EPSS 0.3%CVE-2026-116773MEDIUMrussh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsEPSS 0.3%CVE-2026-46709HIGHTabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)EPSS 0.3%CVE-2026-48107MEDIUMRussh: Unchecked keyboard-interactive prompt count in client auth pathEPSS 0.2%CVE-2026-46705MEDIUMrussh server userauth state is not reset when authentication principal changesEPSS 0.2%CVE-2026-102820MEDIUMpageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)EPSS 0.2%CVE-2026-45038HIGHTabby: Dragging and Dropping a File into Tabby Can Lead to Code ExecutionEPSS 0.2%CVE-2026-116794HIGHrussh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationEPSS 0.2%CVE-2026-102824MEDIUMRussh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeEPSS 0.1%CVE-2026-45037HIGHTabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocationEPSS 0.1%CVE-2026-45036HIGHTabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zshEPSS 0.1%CVE-2026-116696LOWrussh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesEPSS 0.1%