OP
Product
OpenSSL
On CISA KEVExploited in the wild
317
CVEs
1
On KEV
9.8
Max CVSS
14
New 30D
Severity mix
Critical 17High 87Medium 74Low 13
Watch
Add OpenSSL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63073 | 9.8 | Aug 25 | Untrusted Sender DN Used as Format String in CMP Response Validation Affected: 4.0.0 before 4.0.2; 3.6.0 before 3.6.4; 3.5.0 before 3.5.8; 3.4.0 before 3.4.7 |
| CVE-2026-31789 | 9.8 | Apr 7 | Heap Buffer Overflow in Hexadecimal Conversion Affected: 3.6.0 before 3.6.2; 3.5.0 before 3.5.6; 3.4.0 before 3.4.5; 3.3.0 before 3.3.7; 3.0.0 before 3.0.20 |
| CVE-2022-2274 | 9.8 | Jul 1 | RSA implementation bug in AVX512IFMA instructions Affected: Affects OpenSSL 3.0.4 |
| CVE-2021-3711 | 9.8 | Aug 24 | SM2 Decryption Buffer Overflow Affected: Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k) |
| CVE-2016-6309 | 9.8 | Sep 26 | statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or… Affected: 1.1.0a |
| CVE-2016-6303 | 9.8 | Sep 16 | Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and… Affected: 1.0.1; 1.0.1a; 1.0.1b; 1.0.1c; 1.0.1d; 1.0.1e; +24 more |
| CVE-2016-2182 | 9.8 | Sep 16 | The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service… Affected: 1.0.1; 1.0.1a; 1.0.1b; 1.0.1c; 1.0.1d; 1.0.1e; +24 more |
| CVE-2016-2177 | 9.8 | Jun 20 | OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and… Affected: 1.0.1; 1.0.1a; 1.0.1b; 1.0.1c; 1.0.1d; 1.0.1e; +24 more |
| CVE-2016-2108 | 9.8 | May 5 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and… Affected: through 1.0.1n; 1.0.2; 1.0.2; 1.0.2; 1.0.2; 1.0.2a; +1 more |
| CVE-2016-2842 | 9.8 | Mar 3 | The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +26 more |
| CVE-2016-0799 | 9.8 | Mar 3 | The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +26 more |
| CVE-2016-0705 | 9.8 | Mar 3 | Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a… Affected: 1.0.1; 1.0.1; 1.0.1; 1.0.1; 1.0.1a; 1.0.1b; +26 more |
| CVE-2009-3555 | 9.8 | Nov 9 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and… Affected: through 0.9.8k; 1.0 |
| CVE-2003-0545 | 9.8 | Nov 17 | Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a… Affected: 0.9.6; 0.9.7 |
| CVE-2026-75803 | 9.1 | Aug 25 | AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() Affected: 4.0.0 before 4.0.2; 3.6.0 before 3.6.4; 3.5.0 before 3.5.8; 3.4.0 before 3.4.7; 3.0.0 before 3.0.22 |
| CVE-2026-34182 | 9.1 | Jun 9 | CMS AuthEnvelopedData Processing May Accept Forged Messages Affected: 4.0.0 before 4.0.1; 3.6.0 before 3.6.3; 3.5.0 before 3.5.7; 3.4.0 before 3.4.6; 3.0.0 before 3.0.21 |
| CVE-2024-5535 | 9.1 | Jun 27 | SSL_select_next_proto buffer overread Affected: 3.3.0 before 3.3.2; 3.2.0 before 3.2.3; 3.1.0 before 3.1.7; 3.0.0 before 3.0.15; 1.1.1 before 1.1.1za; 1.0.2 before 1.0.2zk |
Showing 17