6
CVEs
3
Critical
3
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-53545 | OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-53546 | Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood. | CRITICAL | 9.6 | 0.4% | 48 |
|
| CVE-2026-53548 | Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV. | CRITICAL | 9.6 | 0.4% | 48 |
|
| CVE-2026-53542 | Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments. | HIGH | 8.8 | 0.5% | 44 |
|
| CVE-2026-53547 | Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-53549 | Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure. | HIGH | 7.7 | 0.4% | 39 |
|