CVE-2026-44405

LowCVSS 3.4/10Last modified Jul 24, 2026

Description

In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-327

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ParamikoParamiko< a4489456b6f65281e172380cc4826cee5e851dbb

References

Timeline

Published
May 6, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-444067.8ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successCVE-2026-444077.5A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denialCVE-2026-444086.3There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attackCVE-2026-444097.5There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers CVE-2026-44418.8Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craftCVE-2026-444103.8This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, CVE-2026-444117.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uninitiCVE-2026-444127.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based oCVE-2026-444137.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessCVE-2026-444146.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge DeviceCVE-2026-444159.1Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remotCVE-2026-444169.8Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended
CVE-2026-44405: Low severity, CVSS 3.4 | Vulnix