Termix-ssh Termix vulnerabilities

• termix-ssh termix Termix-SSH Termix transferToHost path traversal CVE-2026-120322 9.4 CriticalNovember 2, 2026
• termix-ssh termix Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749) CVE-2026-79763 5.3 MediumSeptember 24, 2026
• termix-ssh termix Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist CVE-2026-79764 7.7 HighSeptember 24, 2026
• termix-ssh termix Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy CVE-2026-79762 5.5 MediumSeptember 24, 2026
• termix-ssh termix Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email CVE-2026-79766 9.1 CriticalSeptember 24, 2026
• termix-ssh termix Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint CVE-2026-79759 4.3 MediumSeptember 24, 2026
• termix-ssh termix Termix: Command injection in SSH key deployment verification CVE-2026-79761 6.6 MediumSeptember 24, 2026
• termix-ssh termix Termix: Authenticated users can read other users' host status and clear global SSH connections CVE-2026-79758 5.4 MediumSeptember 24, 2026
• termix-ssh termix Termix: Authenticated blind SSRF through notification channel test endpoints CVE-2026-79760 6.4 MediumSeptember 24, 2026
• termix-ssh termix Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection CVE-2026-53545 9.8 CriticalAugust 19, 2026
• termix-ssh termix Termix: Missing authorization in SSH host credential resolution exposes stored credentials CVE-2026-53546 9.6 CriticalAugust 19, 2026
• termix-ssh termix Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts CVE-2026-53542 8.8 HighAugust 19, 2026
• termix-ssh termix Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users CVE-2026-53548 9.6 CriticalAugust 19, 2026
• termix-ssh termix Termix: Account Takeover via Global Settings Disclosure CVE-2026-53547 8.8 HighAugust 19, 2026
• termix-ssh termix Termix: Server-Side Request Forgery via Proxy Connectivity Test CVE-2026-53549 7.7 HighAugust 19, 2026
• termix Termix Vulnerable to Arbitrary Command Execution in File Manager CVE-2026-45750 9.0 CriticalJune 5, 2026
• termix Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password CVE-2026-45749 8.1 HighJune 5, 2026
• termix Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection CVE-2026-45748 9.8 CriticalJune 5, 2026
• termix Termix Vulnerable to Arbitrary Command Execution via Session Hijacking CVE-2026-45746 Public exploit 9.0 CriticalJune 5, 2026
• termix Termix has an OS Command Injection in File Manager resolvePath endpoint CVE-2026-45744 9.9 CriticalJune 5, 2026
• termix Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) CVE-2026-45743 8.1 HighJune 5, 2026
• termix Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft CVE-2026-45745 8.0 HighJune 5, 2026
• termix-ssh termix Termix: OS Command Injection in Docker Container Management Endpoints CVE-2026-42454 9.9 CriticalMay 8, 2026
• termix-ssh termix Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass CVE-2026-42453 8.7 HighMay 8, 2026
• termix-ssh termix Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP CVE-2026-42452 8.1 HighMay 8, 2026
• termix Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser CVE-2026-22804 Public exploit 8.0 HighJanuary 12, 2026
• lukegus termix Termix' official Docker image contains an authentication bypass vulnerability CVE-2025-59951 9.2 CriticalOctober 1, 2025