- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 09/12/2026, OpenBSD recorded 15 security vulnerabilities in the last 90 days across 3 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, OpenSSH had the most security vulnerabilities in the OpenBSD ecosystem, with 11 vulnerabilities—approximately 73.33% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-56101OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS | Exploitation statusPublic exploit | FixYes | Affected productOpenBSD | Published09/08/2026 | SeverityMedium |
CVE-2026-73283 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published08/11/2026 | SeverityLow |
CVE-2026-73282 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published08/11/2026 | SeverityMedium |
CVE-2026-73281 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published08/11/2026 | SeverityLow |
CVE-2026-60002 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityHigh |
CVE-2026-60001 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-60000 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityLow |
CVE-2026-59999 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-59998 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-59997 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-59996 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-59995 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published07/08/2026 | SeverityMedium |
CVE-2026-57589 | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published06/25/2026 | SeverityHigh |
CVE-2026-55654Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published06/23/2026 | SeverityLow |
CVE-2026-55655Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published06/23/2026 | SeverityMedium |
CVE-2026-55653Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published06/23/2026 | SeverityMedium |
CVE-2026-56099OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input | Exploitation statusPublic exploit | FixYes | Affected productsrc | Published06/18/2026 | SeverityMedium |
CVE-2026-55706 | Exploitation statusPublic exploit | FixYes | Affected productOpenBSD | Published06/17/2026 | SeverityMedium |
CVE-2026-41285 | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published04/20/2026 | SeverityMedium |
CVE-2026-35414 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/02/2026 | SeverityMedium |
CVE-2026-35388 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/02/2026 | SeverityLow |
CVE-2026-35387 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/02/2026 | SeverityLow |
CVE-2026-35386 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/02/2026 | SeverityLow |
CVE-2026-35385 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/02/2026 | SeverityHigh |
CVE-2026-3497 | Exploitation statusNot known exploited | FixYes | Affected productopenssh | Published03/12/2026 | SeverityLow |
CVE-2025-61984 | Exploitation statusPublic exploit | FixYes | Affected productOpenSSH | Published10/06/2025 | SeverityLow |
CVE-2025-61985 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published10/06/2025 | SeverityLow |
CVE-2025-32728 | Exploitation statusNot known exploited | FixYes | Affected productOpenSSH | Published04/10/2025 | SeverityMedium |
CVE-2025-30334OpenBSD wg(4) kernel crash | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published03/20/2025 | SeverityHigh |
CVE-2025-26466Openssh: denial-of-service in openssh | Exploitation statusPublic exploit | FixYes | Affected productOpenSSH | Published02/28/2025 | SeverityMedium |
CVE-2025-26465Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled | Exploitation statusPublic exploit | FixYes | Affected productRed Hat Enterprise Linux 8 | Published02/18/2025 | SeverityMedium |
CVE-2024-11149OpenBSD vmm GDTR limits | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published12/06/2024 | SeverityMedium |
CVE-2024-10933OpenBSD readdir directory traversal | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published12/05/2024 | SeverityMedium |
CVE-2024-11148OpenBSD httpd(8) null dereference | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published12/05/2024 | SeverityHigh |
CVE-2024-10934OpenBSD NFS double-free vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productOpenBSD | Published11/15/2024 | SeverityCritical |
CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos | Exploitation statusPublic exploit | FixYes | Affected productRed Hat Enterprise Linux 9 | Published07/01/2024 | SeverityHigh |
CVE-2021-35000OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productKernel | Published05/07/2024 | SeverityLow |
CVE-2021-34999OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productKernel | Published05/07/2024 | SeverityLow |
CVE-2024-29937 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/21/2024 | SeverityCritical |
CVE-2023-52558OpenBSD 7.4 and 7.3 m_split() network buffer kernel crash | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published03/01/2024 | SeverityHigh |
CVE-2023-52557OpenBSD 7.3 invalid l2tp message npppd crash | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published03/01/2024 | SeverityHigh |
CVE-2023-52556OpenBSD 7.4 pf state race condition kernel crash | Exploitation statusNot known exploited | FixYes | Affected productOpenBSD | Published03/01/2024 | SeverityMedium |
CVE-2023-51767 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/24/2023 | SeverityHigh |
CVE-2023-51384 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/18/2023 | SeverityMedium |
CVE-2023-51385 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/18/2023 | SeverityMedium |
CVE-2023-48795 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/18/2023 | SeverityMedium |
CVE-2023-40216 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/10/2023 | SeverityUnknown |
CVE-2023-38408 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/20/2023 | SeverityCritical |
CVE-2023-35784 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/16/2023 | SeverityUnknown |
CVE-2021-46880 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/14/2023 | SeverityCritical |
CVE-2022-48437 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/12/2023 | SeverityMedium |
CVE-2023-29323 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/04/2023 | SeverityUnknown |
CVE-2023-28531 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/17/2023 | SeverityUnknown |
CVE-2023-27567 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/03/2023 | SeverityUnknown |
CVE-2023-25136 | Exploitation statusPublic exploit | FixYes | Affected productNot confirmed | Published02/03/2023 | SeverityUnknown |
CVE-2022-27882 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/25/2022 | SeverityUnknown |
CVE-2022-27881 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/25/2022 | SeverityUnknown |
CVE-2021-36368 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/12/2022 | SeverityLow |
CVE-2021-41617 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/26/2021 | SeverityUnknown |
CVE-2021-41581 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/24/2021 | SeverityUnknown |
CVE-2016-20012 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/15/2021 | SeverityMedium |
CVE-2019-25049 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2019-25048 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2010-4816 | Exploitation statusNot confirmed | FixNot confirmed | Affected productFreeBSD and OpenBSD ftpd service | Published06/22/2021 | SeverityUnknown |
CVE-2020-26142 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/11/2021 | SeverityUnknown |
CVE-2021-28041 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/05/2021 | SeverityUnknown |
CVE-2020-16088 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/28/2020 | SeverityUnknown |
CVE-2020-15778 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published07/24/2020 | SeverityHigh |
CVE-2020-14145 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/29/2020 | SeverityMedium |
CVE-2020-12062 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/01/2020 | SeverityUnknown |
CVE-2011-3336 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmacOS | Published02/12/2020 | SeverityUnknown |
CVE-2020-7247 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published01/29/2020 | SeverityCritical |
CVE-2015-5333 | Exploitation statusNot confirmed | FixNot confirmed | Affected productLibreSSL | Published01/23/2020 | SeverityUnknown |
CVE-2015-5334 | Exploitation statusNot confirmed | FixNot confirmed | Affected productLibreSSL | Published01/23/2020 | SeverityUnknown |
CVE-2012-5663 | Exploitation statusNot confirmed | FixNot confirmed | Affected producttextproc/isearch package | Published12/30/2019 | SeverityUnknown |
CVE-2019-19726 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/12/2019 | SeverityUnknown |
CVE-2019-14899 | Exploitation statusNot confirmed | FixNot confirmed | Affected productVPN | Published12/11/2019 | SeverityHigh |
CVE-2012-1577 | Exploitation statusNot confirmed | FixNot confirmed | Affected productdietlibc | Published12/10/2019 | SeverityUnknown |
CVE-2019-19519 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/04/2019 | SeverityUnknown |
CVE-2019-19520 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/04/2019 | SeverityUnknown |
CVE-2019-19521 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/04/2019 | SeverityUnknown |
CVE-2019-19522 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/04/2019 | SeverityUnknown |
CVE-2019-16905 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/09/2019 | SeverityUnknown |
CVE-2019-8460 | Exploitation statusNot confirmed | FixNot confirmed | Affected productOpenBSD | Published08/26/2019 | SeverityUnknown |
CVE-2019-6111 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/31/2019 | SeverityMedium |
CVE-2019-6110 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/31/2019 | SeverityMedium |
CVE-2019-6109 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/31/2019 | SeverityMedium |
CVE-2018-20685 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/10/2019 | SeverityMedium |
CVE-2018-15919 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/28/2018 | SeverityMedium |
CVE-2018-15473 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/17/2018 | SeverityMedium |
CVE-2018-14775 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/01/2018 | SeverityUnknown |
CVE-2018-12434 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/15/2018 | SeverityUnknown |
CVE-2018-8970 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/24/2018 | SeverityUnknown |
CVE-2016-10708 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/21/2018 | SeverityHigh |
CVE-2017-15906 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/26/2017 | SeverityMedium |
CVE-2015-7687 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/16/2017 | SeverityUnknown |
CVE-2017-1000373 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published06/19/2017 | SeverityUnknown |
CVE-2017-1000372 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/19/2017 | SeverityUnknown |
CVE-2017-8301 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/27/2017 | SeverityUnknown |
CVE-2016-1908 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/11/2017 | SeverityCritical |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan