WI
Vendor
wolfSSL Inc.
10
CVEs
0
On KEV
4
New 30D
Products
WO9.1
wolfSSH
wolfSSL Inc.
4 CVEs0 on KEV4 new
WO7.4
wolfEngine
wolfSSL Inc.
2 CVEs0 on KEV0 new
WO7.4
wolfProvider
wolfSSL Inc.
1 CVEs0 on KEV0 new
WO9.8
wolfSSL
wolfSSL Inc.
1 CVEs0 on KEV0 new
WW5.2
wolfSSL (wolfCrypt)
wolfSSL Inc.
1 CVEs0 on KEV0 new
WO1.0
wolfTPM
wolfSSL Inc.
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84897 | WO wolfSSH wolfSSL Inc. | 5.3 | Oct 7 | wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion |
| CVE-2026-83742 | WO wolfSSH wolfSSL Inc. | 8.8 | Oct 7 | wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms |
| CVE-2026-81535 | WO wolfSSH wolfSSL Inc. | 9.1 | Oct 7 | wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check |
| CVE-2026-16516 | WO wolfSSH wolfSSL Inc. | 7.4 | Oct 7 | wolfSSH ECDSA host key curve not validated against negotiated algorithm |
| CVE-2026-81341 | WO wolfEngine wolfSSL Inc. | 6.5 | Aug 28 | wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records |
| CVE-2026-81020 | WO wolfEngine wolfSSL Inc. | 7.4 | Aug 28 | wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record |
| CVE-2026-81019 | WO wolfProvider wolfSSL Inc. | 7.4 | Aug 28 | wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record |
| CVE-2026-3849 | WO wolfSSL wolfSSL Inc. | 9.8 | Mar 19 | Buffer Overflow in HPKE via Oversized ECH Config |
| CVE-2026-3503 | WW wolfSSL (wolfCrypt) wolfSSL Inc. | 5.2 | Mar 19 | Fault injection attack with ML-DSA and ML-KEM on ARM |
| CVE-2025-7844 | WO wolfTPM wolfSSL Inc. | 1.0 | Aug 4 | wolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflow |