OP
Vendor
OpenBSD
375
CVEs
1
On KEV
16
New 30D
Products
OP9.8
OpenSSH
OpenBSD
150 CVEs0 on KEV11 new
LI9.8
LibreSSL
OpenBSD
16 CVEs0 on KEV4 new
OP9.8
OpenBSD
OpenBSD
203 CVEs0 on KEV1 new
OP9.8
OpenSMTPD
OpenBSD
3 CVEs1 on KEV0 new
FT–
Ftpd
Openbsd
1 CVEs0 on KEV0 new
SR5.3
src
openbsd
1 CVEs0 on KEV0 new
TE7.5
Textproc/isearch
Openbsd
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118374 New | LI LibreSSL OpenBSD | 5.9 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-106583 | OP OpenSSH OpenBSD | 7.8 | Oct 6 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection |
| CVE-2026-106589 | OP OpenSSH OpenBSD | 2.9 | Oct 6 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges |
| CVE-2026-106588 | OP OpenSSH OpenBSD | 3.1 | Oct 6 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected |
| CVE-2026-106587 | OP OpenSSH OpenBSD | 3.3 | Oct 6 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled |
| CVE-2026-106586 | OP OpenSSH OpenBSD | 4.3 | Oct 6 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than… |
| CVE-2026-106585 | OP OpenSSH OpenBSD | 6.5 | Oct 6 | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data |
| CVE-2026-106584 | OP OpenSSH OpenBSD | 3.3 | Oct 6 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling |
| CVE-2026-106582 | OP OpenSSH OpenBSD | 3.7 | Oct 6 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings |
| CVE-2026-106555 | OP OpenSSH OpenBSD | 7.5 | Oct 6 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts |
| CVE-2026-106553 | OP OpenSSH OpenBSD | 7.5 | Oct 6 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt |
| CVE-2026-106552 | OP OpenSSH OpenBSD | 6.5 | Oct 6 | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation |
| CVE-2026-103547 | OP OpenBSD OpenBSD | 9.2 | Sep 30 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and… |
| CVE-2026-56101 | OP OpenBSD OpenBSD | 5.3 | Sep 8 | OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS |
| CVE-2026-73283 | OP OpenSSH OpenBSD | 2.5 | Aug 11 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not |
| CVE-2026-73282 | OP OpenSSH OpenBSD | 4.8 | Aug 11 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent |
| CVE-2026-73281 | OP OpenSSH OpenBSD | 3.5 | Aug 11 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys |
| CVE-2026-60002 | OP OpenSSH OpenBSD | 9.4 | Jul 8 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange |
| CVE-2026-60001 | OP OpenSSH OpenBSD | 6.5 | Jul 8 | sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay |
| CVE-2026-60000 | OP OpenSSH OpenBSD | 7.5 | Jul 8 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled… |
| CVE-2026-59999 | OP OpenSSH OpenBSD | 7.5 | Jul 8 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not |
| CVE-2026-59998 | OP OpenSSH OpenBSD | 6.5 | Jul 8 | sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory |
| CVE-2026-59997 | OP OpenSSH OpenBSD | 5.4 | Jul 8 | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to… |
| CVE-2026-59996 | OP OpenSSH OpenBSD | 5.4 | Jul 8 | scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations |
| CVE-2026-59995 | OP OpenSSH OpenBSD | 5.4 | Jul 8 | sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server |
| CVE-2026-57589 | OP OpenBSD OpenBSD | 7.8 | Jun 25 | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root |
| CVE-2026-55654 | OP Openssh Openbsd | 3.7 | Jun 23 | Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination |
| CVE-2026-55655 | OP Openssh Openbsd | 6.1 | Jun 23 | Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions |
| CVE-2026-55653 | OP Openssh Openbsd | 6.5 | Jun 23 | Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service |
| CVE-2026-56099 | SR src openbsd | 5.3 | Jun 18 | OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input |
| CVE-2026-55706 | OP OpenBSD OpenBSD | 8.3 | Jun 17 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths |
| CVE-2026-41285 | OP OpenBSD OpenBSD | 4.3 | Apr 20 | In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero,… |
| CVE-2026-35414 | OP OpenSSH OpenBSD | 8.1 | Apr 2 | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes… |
| CVE-2026-35388 | OP OpenSSH OpenBSD | 2.5 | Apr 2 | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions |
| CVE-2026-35387 | OP OpenSSH OpenBSD | 6.5 | Apr 2 | OpenSSH before 10.3 can use unintended ECDSA algorithms |
| CVE-2026-35386 | OP OpenSSH OpenBSD | 8.1 | Apr 2 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line |
| CVE-2026-35385 | OP OpenSSH OpenBSD | 8.1 | Apr 2 | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O… |
| CVE-2026-3497 | OP Openssh Openbsd | 7.5 | Mar 12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions |
| CVE-2025-61985 | OP OpenSSH OpenBSD | 3.6 | Oct 6 | ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used |
| CVE-2025-61984 | OP OpenSSH OpenBSD | 3.6 | Oct 6 | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand… |
| CVE-2025-32728 | OP OpenSSH OpenBSD | 3.8 | Apr 10 | In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding |
| CVE-2025-30334 | OP Openbsd Openbsd | 6.5 | Mar 20 | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash |
| CVE-2025-26466 | OP Openssh Openbsd | 5.9 | Feb 28 | Openssh: denial-of-service in openssh |
| CVE-2025-26465 | OP Openssh Openbsd | 6.8 | Feb 18 | Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled |
| CVE-2024-11149 | OP Openbsd Openbsd | 5.5 | Dec 6 | In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs |
| CVE-2024-11148 | OP Openbsd Openbsd | 7.5 | Dec 5 | In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request |
| CVE-2024-10933 | OP Openbsd Openbsd | 5.5 | Dec 5 | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems |
| CVE-2024-10934 | OP Openbsd Openbsd | 9.8 | Nov 15 | In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in… |
| CVE-2024-6387 | OP Openssh Openbsd | 8.1 | Jul 1 | Openssh: regresshion - race condition in ssh allows rce/dos |
| CVE-2021-35000 | OP Openbsd Openbsd | 3.3 | May 7 | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability |
| CVE-2021-34999 | OP Openbsd Openbsd | 5.5 | May 7 | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability |
| CVE-2024-29937 | OP Openbsd Openbsd | 9.8 | Apr 11 | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to… |
| CVE-2023-52558 | OP Openbsd Openbsd | 7.5 | Mar 1 | In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially… |
| CVE-2023-52557 | OP Openbsd Openbsd | 7.5 | Mar 1 | In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length |
| CVE-2023-52556 | OP Openbsd Openbsd | 6.2 | Mar 1 | In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic |
| CVE-2023-51767 | OP Openssh Openbsd | 7.0 | Dec 24 | OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in… |
| CVE-2023-48795 | OP Openssh Openbsd | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… |