Filtered by vendor Openbsd
Subscribe
Total
358 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-59995 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server. | |||||
| CVE-2026-59996 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. | |||||
| CVE-2026-59997 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.2 MEDIUM |
| internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection. | |||||
| CVE-2026-59998 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 4.8 MEDIUM |
| sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. | |||||
| CVE-2026-59999 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 5.9 MEDIUM |
| In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. | |||||
| CVE-2026-60000 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 3.7 LOW |
| sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication. | |||||
| CVE-2026-60001 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 6.5 MEDIUM |
| sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. | |||||
| CVE-2026-60002 | 1 Openbsd | 1 Openssh | 2026-07-09 | N/A | 7.7 HIGH |
| ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.) | |||||
| CVE-2025-26466 | 3 Canonical, Debian, Openbsd | 3 Ubuntu Linux, Debian Linux, Openssh | 2026-06-30 | N/A | 5.9 MEDIUM |
| A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack. | |||||
| CVE-2026-41285 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 4.3 MEDIUM |
| In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero. | |||||
| CVE-2025-32728 | 2 Debian, Openbsd | 2 Debian Linux, Openssh | 2026-06-17 | N/A | 4.3 MEDIUM |
| In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. | |||||
| CVE-2025-30334 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 6.5 MEDIUM |
| In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. | |||||
| CVE-2024-29937 | 2 Freebsd, Openbsd | 2 Freebsd, Openbsd | 2026-06-17 | N/A | 9.8 CRITICAL |
| NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption. | |||||
| CVE-2024-11149 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.9 HIGH |
| In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs. | |||||
| CVE-2024-11148 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. | |||||
| CVE-2024-10934 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 9.8 CRITICAL |
| In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server. | |||||
| CVE-2024-10933 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 5.0 MEDIUM |
| In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems. | |||||
| CVE-2023-52558 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences. | |||||
| CVE-2023-52557 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 7.5 HIGH |
| In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. | |||||
| CVE-2023-52556 | 1 Openbsd | 1 Openbsd | 2026-06-17 | N/A | 6.2 MEDIUM |
| In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic. | |||||