These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-45309 is a path traversal vulnerability in AsyncSSH, a Python package providing an asynchronous client and server implementation of the SSHv2 protocol. The vulnerability allows a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, or .. path traversal segments and authenticate with an attacke [truncated]
CVE-2026-54591 is a high-severity vulnerability in the AsyncSSH Python package, allowing a malicious SSH server to write arbitrary files on the AsyncSSH SCP client's filesystem by sending filenames containing ../ traversal sequences. This issue is fixed in version 2.23.1. Affected users should update to prevent potential file writes on their systems. The vulnerability arises from the _parse_cd_args functi [truncated]
CVE-2026-54590 is a path traversal vulnerability in AsyncSSH, a Python package for asynchronous SSHv2 protocol implementation. The issue arises from an incomplete fix for CVE-2026-45309 in version 2.23.0, which fails to block leading ~ or ${ENV} in AuthorizedKeysFile, allowing path expansion. This vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. The issue has been fixed in versi [truncated]