CVE-2026-59999

HighCVSS 7.5/10Last modified Jul 9, 2026

Description

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-348

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-60004.3A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sqCVE-2026-600007.5sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptCVE-2026-600016.5sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-600029.4ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only CVE-2026-600049.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.CVE-2026-600058.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex capturCVE-2026-600077.4In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aCVE-2026-600083.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitizationCVE-2026-600098.8In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled CVE-2026-60018.8Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted IdentifiersCVE-2026-600106.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a rCVE-2026-600115.3Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the
CVE-2026-59999: High severity, CVSS 7.5 | Vulnix