Crypto
Vendor:
First CVE: Apr 4, 2017 · Active for 9 years
19
Total CVEs
More Total CVEs than 93% of tracked products
3.8
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Crypto over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 4, 2017
9 years ago
Most Recent CVE
May 22, 2026
64 days ago
CVE Severity & Scoring
Crypto19 CVEs
37%
26%
37%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network19 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (78.9%)
High4 (21.1%)
Unknown0 (0.0%)
User Interaction
None19 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (10.5%)
High0 (0.0%)
None17 (89.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2026-46595CRITICAL Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-addre | May 22, 2026 | 10.0 | 44 | NO | NO |
CVE-2026-39830CRITICAL A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by | May 22, 2026 | 9.1 | 43 | NO | NO |
CVE-2026-42508CRITICAL Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. | May 22, 2026 | 9.1 | 42 | NO | NO |
CVE-2026-39834CRITICAL When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, | May 22, 2026 | 9.1 | 42 | NO | NO |
CVE-2026-39832CRITICAL When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently st | May 22, 2026 | 9.1 | 42 | NO | NO |
CVE-2026-39831CRITICAL The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated with | May 22, 2026 | 9.1 | 41 | NO | NO |
CVE-2026-39828HIGH When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restri | May 22, 2026 | 8.8 | 41 | NO | NO |
CVE-2026-39833CRITICAL The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt | May 22, 2026 | 9.1 | 40 | NO | NO |
CVE-2026-46597HIGH An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. | May 22, 2026 | 7.5 | 38 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (19 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (19 CVEs).
Media Mentions
Signals from CVEs in this product scope (19 CVEs).
Top CNAs Publishing CVEs For Crypto
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2019-03-25 | 1 | 5.9 | 2.0% | 0 | 0 |