[ Vendor · 14 CVEs ]
OpenBSD
CVEs affecting OpenBSD published in the last 30 days, plus any OpenBSD CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106583 | 7 Oct 2026 | CVSS 7.8 | OpenBSD OpenSSHIn ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | |
| CVE-2026-106587 | 6 Oct 2026 | CVSS 3.3 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a… | |
| CVE-2026-106588 | 6 Oct 2026 | CVSS 3.1 | OpenBSD OpenSSHIn sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. | |
| CVE-2026-106589 | 6 Oct 2026 | CVSS 2.9 | OpenBSD OpenSSHIn sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This… | |
| CVE-2026-106553 | 6 Oct 2026 | CVSS 7.5 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | |
| CVE-2026-106555 | 6 Oct 2026 | CVSS 7.5 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | |
| CVE-2026-106582 | 6 Oct 2026 | CVSS 3.7 | OpenBSD OpenSSHIn sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing… | |
| CVE-2026-106584 | 6 Oct 2026 | CVSS 3.3 | OpenBSD OpenSSHIn ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a… | |
| CVE-2026-106585 | 6 Oct 2026 | CVSS 6.5 | OpenBSD OpenSSHIn sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed… | |
| CVE-2026-106586 | 6 Oct 2026 | CVSS 4.3 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different… | |
| CVE-2026-106552 | 6 Oct 2026 | CVSS 6.5 | OpenBSD OpenSSHIn sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive… | |
| CVE-2026-103547 | 30 Sep 2026 | CVSS 9.2 | OpenBSDIn ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child… | |
| CVE-2020-7247 | 29 Jan 2020 | CVSS 9.8 | OpenSMTPD Remote Code Executionsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as… | ExploitedFix |
| CVE-2020-7247 | 29 Jan 2020 | CVSS 9.8 | OpenSMTPD Remote Code Executionsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as… | ExploitedFix |