Total
208 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-56099 | 1 Openbsd | 1 Openbsd | 2026-07-14 | N/A | 5.3 MEDIUM |
| OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set. | |||||
| CVE-2026-55706 | 1 Openbsd | 1 Openbsd | 2026-07-13 | N/A | 5.8 MEDIUM |
| sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. | |||||
| CVE-2026-57589 | 1 Openbsd | 1 Openbsd | 2026-07-10 | N/A | 7.4 HIGH |
| sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget(). | |||||
| CVE-2026-41285 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 4.3 MEDIUM |
| In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero. | |||||
| CVE-2025-30334 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 6.5 MEDIUM |
| In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. | |||||
| CVE-2024-29937 | 2 Freebsd, Openbsd | 2 Freebsd, Openbsd | 2026-06-17 | N/A | 9.8 CRITICAL |
| NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption. | |||||
| CVE-2024-11149 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.9 HIGH |
| In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs. | |||||
| CVE-2024-11148 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. | |||||
| CVE-2024-10934 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 9.8 CRITICAL |
| In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server. | |||||
| CVE-2024-10933 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 5.0 MEDIUM |
| In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems. | |||||
| CVE-2023-52558 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences. | |||||
| CVE-2023-52557 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. | |||||
| CVE-2023-52556 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 6.2 MEDIUM |
| In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic. | |||||
| CVE-2023-40216 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 5.5 MEDIUM |
| OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences. | |||||
| CVE-2023-38283 | 2 Openbgpd, Openbsd | 2 Openbgpd, Openbsd | 2026-06-17 | N/A | 5.3 MEDIUM |
| In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006. | |||||
| CVE-2023-35784 | 1 Openbsd | 2 Libressl, Openbsd | 2026-06-17 | N/A | 9.8 CRITICAL |
| A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected. | |||||
| CVE-2023-29323 | 2 Openbsd, Opensmtpd | 2 Openbsd, Opensmtpd | 2026-06-17 | N/A | 7.8 HIGH |
| ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address. | |||||
| CVE-2023-27567 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. | |||||
| CVE-2022-48437 | 1 Openbsd | 2 Libressl, Openbsd | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate. | |||||
| CVE-2022-27882 | 1 Openbsd | 1 Openbsd | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation. | |||||