@alecmuffett @mdfranz @dave_aitel A large number of those are in integrations with insecure junkware, hardware vulnerabilities unrelated to OpenSSH, tools other than the sshd either distributed with or entirely independent of OpenSSH itself, etc. The double free looks a real serious one but was only briefly introduced and seems to have affected users following latest version rather than longterm.