P
PuTTY
Security Risk Profile
22
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 42 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from June 1, 2000 to present
42
Total CVEs
20
Critical+High
1
Exploited
9
Unpatched
Threat Assessment
Avg CVSS
6.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
9
Critical/High
Risk Level
22/100
low
⚠️ 1 Active Exploits
Severity Distribution
Critical
9High
11Medium
11Low
7Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
Buffer Overflow
11
2
Input Validation
4
3
Infoleak
2
4
Integer Overflow
2
5
Double Free
1
Most Affected Products
1. alpine/putty158
2. Putty PuTTY154
3. WinSCP WinSCP41
4. Cisco IOS32
5. Fedoraproject Fedora17
Recent Vulnerabilities
See more →CVE-2026-48852
CVSS 3.7low
May 25, 2026
CVE-2026-48851
CVSS 3.1low
May 25, 2026
CVE-2026-48850
CVSS 5.9medium
May 25, 2026
https://seclists.org/oss-sec/2026/q2/688
unknown
PuTTY 0.84 leased with 3 minor security fixes
May 24, 2026🔧 No Patch
CVE-2026-4115
CVSS 2.9EPSS 0%low
PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification
Mar 22, 2026🔧 No Patch
https://www.bleepingcomputer.com/news/security/putty-ssh-client-flaw-allows-recovery-of-cryptographic-private-keys/
unknown
PuTTY SSH client flaw allows recovery of cryptographic private keys
Apr 16, 2024⚠ Exploited🔧 No Patch
https://seclists.org/oss-sec/2024/q2/122
unknown
CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client
Apr 15, 2024🔧 No Patch
CVE-2024-31497
CVSS 5.9EPSS 0%medium
Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client
Apr 15, 2024
https://seclists.org/oss-sec/2023/q4/297
unknown
CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack)
Dec 19, 2023🔧 No Patch
PYSEC-2026-1758
CVSS 5.9medium
Dec 18, 2023🔧 No Patch
Monitor PuTTY in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.