CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product freebsd:freebsd. Show all products

87 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2019-6111Medium 5.9An issue was discovered in OpenSSH 7.9.
Assigned by mitre
Jan 31, 2019
CVE-2019-12900Critical 9.8BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Assigned by mitre
Jun 19, 2019
CVE-2020-1967High 7.5Segmentation fault in SSL_check_chain
Assigned by openssl
Apr 21, 2020
CVE-2020-13434Medium 5.5SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
Assigned by mitre
May 24, 2020
CVE-2021-3449Medium 5.9NULL pointer deref in signature_algorithms processing
Assigned by openssl
Mar 25, 2021
CVE-2021-3450High 7.4CA certificate check bypass with X509_V_FLAG_X509_STRICT
Assigned by openssl
Mar 25, 2021
CVE-2023-48795Medium 5.9The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
Assigned by mitre
Dec 18, 2023
CVE-2024-6387High 8.1Openssh: regresshion - race condition in ssh allows rce/dos
Assigned by redhat
Jul 1, 2024
CVE-2025-14558High 7.2The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.Mar 9, 2026
CVE-2025-14769High 7.5In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine.Mar 9, 2026
CVE-2025-15547High 8.8By default, jailed processes cannot mount filesystems, including nullfs(4).Mar 9, 2026
CVE-2025-15576High 7.5If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able t…Mar 9, 2026
CVE-2026-2261High 7.5Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives.Mar 9, 2026
CVE-2026-3038High 7.5The rtsock_msg_buffer() function serializes routing information into a buffer.Mar 9, 2026
CVE-2026-4247High 7.5When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in.Mar 26, 2026
CVE-2026-4652High 7.5On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID.Mar 26, 2026
CVE-2026-4747High 8.8Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet.Mar 26, 2026
CVE-2026-4748High 7.5A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplica…Apr 1, 2026
CVE-2026-5398High 8.4The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session.Apr 22, 2026
CVE-2026-6386Medium 6.2In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries.Apr 22, 2026
CVE-2026-42511High 8.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.Apr 30, 2026
CVE-2026-7270High 7.8An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.Apr 30, 2026
CVE-2026-7164High 7.5Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters.Apr 30, 2026
CVE-2026-35547High 8.1When processing the header of an incoming message, libnv failed to properly validate the message size.Apr 30, 2026
CVE-2026-39457High 7.8When exchanging data over a socket, libnv uses select(2) to wait for data to arrive.Apr 30, 2026
CVE-2026-42512High 8.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.Apr 30, 2026
CVE-2026-45250High 7.8The setcred(2) system call is only available to privileged users.May 21, 2026
CVE-2026-39461High 8.8libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available.May 21, 2026
CVE-2026-45251High 7.8A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor.May 21, 2026
CVE-2026-45252Medium 5.5When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file.May 21, 2026
CVE-2026-45253High 8.4ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls.May 21, 2026
CVE-2026-45254Medium 6.5In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected.May 21, 2026
CVE-2026-45255High 7.5When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network.May 21, 2026
CVE-2026-45256Medium 5.5When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal.Jun 26, 2026
CVE-2026-45257High 7.8The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify.Jun 26, 2026
CVE-2026-45258High 7.8dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size.Jun 27, 2026
CVE-2026-45259Medium 6.5sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal de…Jun 27, 2026
CVE-2026-49412High 7.8The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock.Jun 27, 2026
CVE-2026-49413High 7.1The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag.Jun 27, 2026
CVE-2026-49417High 7.0Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid.Jun 27, 2026
CVE-2026-49414High 7.8The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before.Jun 27, 2026
CVE-2026-49416High 7.8The CONS_HISTORY ioctl handler did not adequately validate the requested history size.Jun 27, 2026
CVE-2026-49418High 8.8Use-after-free in device pager page list
Assigned by freebsd
Aug 19, 2026
CVE-2026-49419High 8.8Jail reference count underflow
Assigned by freebsd
Aug 19, 2026
CVE-2026-49415High 8.8Local privilege escalation via execve(2) TOCTOU race
Assigned by freebsd
Aug 19, 2026
CVE-2026-49429High 7.8Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
Assigned by freebsd
Aug 19, 2026
CVE-2026-49430High 7.8Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
Assigned by freebsd
Aug 19, 2026
CVE-2026-49431Low 3.3Incorrect user validation in ZFS_IOC_SET_PROP ioctl
Assigned by freebsd
Aug 19, 2026
CVE-2026-49420High 8.8Buffer overflow in libalias RTSP handler
Assigned by freebsd
Aug 19, 2026
CVE-2026-49421High 7.1unlinkat(2) ignores AT_RESOLVE_BENEATH flag
Assigned by freebsd
Aug 19, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.