OC
Vendor
OCaml
17
CVEs
0
On KEV
0
New 30D
Products
OC9.8
OCaml
OCaml
6 CVEs0 on KEV0 new
MI6.2
mirage-crypto-ec
OCaml
3 CVEs0 on KEV0 new
OP7.8
opam
OCaml
2 CVEs0 on KEV0 new
CS7.3
cstruct
OCaml
1 CVEs0 on KEV0 new
JO9.1
jose
OCaml
1 CVEs0 on KEV0 new
MI6.2
mirage-crypto
OCaml
1 CVEs0 on KEV0 new
MI4.3
mirage-crypto-pk
OCaml
1 CVEs0 on KEV0 new
PO–
Postgresql-ocaml
Ocaml
1 CVEs0 on KEV0 new
UT7.5
utcp
OCaml
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89087 | CS cstruct OCaml | 7.3 | Sep 10 | The cstruct package before 6.3.0 for OCaml mishandles indexes |
| CVE-2026-89086 | JO jose OCaml | 9.1 | Sep 10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid… |
| CVE-2026-87737 | MI mirage-crypto-ec OCaml | 5.9 | Sep 9 | An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml |
| CVE-2026-87736 | MI mirage-crypto-ec OCaml | 4.3 | Sep 9 | An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml |
| CVE-2026-87735 | MI mirage-crypto-pk OCaml | 4.3 | Sep 9 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml |
| CVE-2026-87734 | UT utcp OCaml | 7.5 | Sep 9 | An issue was discovered in the utcp package before 0.0.6 for OCaml |
| CVE-2026-87733 | MI mirage-crypto-ec OCaml | 6.2 | Sep 9 | An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml |
| CVE-2026-87732 | MI mirage-crypto OCaml | 6.2 | Sep 9 | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml |
| CVE-2026-57825 | OP opam OCaml | 5.7 | Sep 9 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files |
| CVE-2026-41082 | OP opam OCaml | 7.8 | Apr 16 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory |
| CVE-2026-34353 | OC OCaml OCaml | 5.1 | Mar 27 | In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed |
| CVE-2026-28364 | OC OCaml OCaml | 7.8 | Feb 27 | In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain |
| CVE-2018-9838 | OC Ocaml Ocaml | 9.8 | Apr 6 | The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from… |
| CVE-2017-9779 | OC Ocaml Ocaml | 7.8 | Sep 7 | OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact." |
| CVE-2017-9772 | OC Ocaml Ocaml | 9.8 | Jun 23 | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the… |
| CVE-2015-8869 | OC Ocaml Ocaml | 9.1 | Jun 13 | OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a… |
| CVE-2009-2943 | PO Postgresql-ocaml Ocaml | – | Oct 22 | The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage… |