CWE-322

CVEs per yearBy the year they were published

1. 20211
2. 20229
3. 20243
4. 20254
5. 202617

Newest CVEs

• CVE-2026-94423

  Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

  Net-LibSSH

  Critical9.1
• CVE-2026-94140

  Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

  Rex

  Critical9.1
• CVE-2026-94135

  Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

  Apache Software Foundation · Apache Airflow SFTP provider

  Medium4.3
• CVE-2026-94134

  Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

  Apache Software Foundation · Apache Airflow SSH provider

  Critical9.1
• CVE-2026-107675

  FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

  FFmpeg · FFmpeg

  Medium6.0
• CVE-2026-77703

  SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

  HAVELSAN Inc. · Liman Render Engine

  Medium5.9
• CVE-2026-89422

  TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

  Erlang · OTP

  Critical9.3
• CVE-2026-18654

  Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

  AWS · aws-cli

  Medium6.9
• CVE-2026-58065

  Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification

  Apache Software Foundation · Apache Airflow Git provider

  High8.1
• CVE-2026-11745

  A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host…

  LY Corporation · Central Dogma

  High8.8

Vendors it comes up for most

1. matrix-org8
2. Apache Software Foundation4
3. Red Hat2
4. AWS1
5. Arista Networks1
6. Brocade1
7. Checkmk GmbH1
8. Cisco1
9. Erlang1
10. FFmpeg1