Known Vulnerabilities for products from OpenBSD
Listed below are 20 of the newest known vulnerabilities associated with the vendor "OpenBSD".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-106587 json | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was in... | Not Provided | 2026-10-06 | 2026-10-09 |
| CVE-2026-106586 json | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding ... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-106585 json | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompress... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-106584 json | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandli... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-106583 json | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | Not Provided | 2026-10-07 | 2026-10-15 |
| CVE-2026-106582 json | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-106555 json | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication ... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-106553 json | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication at... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-106552 json | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-103547 json | Not Provided | 2026-09-30 | 2026-09-30 | |
| CVE-2026-73283 json | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding ... | Not Provided | 2026-08-11 | 2026-09-04 |
| CVE-2026-73282 json | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations ... | Not Provided | 2026-08-11 | 2026-09-04 |
| CVE-2026-73281 json | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including op... | Not Provided | 2026-08-11 | 2026-09-04 |
| CVE-2026-60002 json | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outco... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-60001 json | sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-60000 json | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authent... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-59999 json | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-59998 json | sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the ser... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-59997 json | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a ... | Not Provided | 2026-07-08 | 2026-07-09 |
| CVE-2026-59996 json | scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two... | Not Provided | 2026-07-08 | 2026-07-09 |