Comment by lxgr

The only one I can think of is the one on Debian where key generation used weak entropy, making keys guessable.

Given its sensitivity, OpenSSH is incredibly battle-hardened and probably better than almost everything else you can run on an exposed port.