WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor openbsd✕
Overview 32 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
32matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 4public PoC12.5% 1EPSS ≥ 0.53.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 32 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 32 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 32 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 12.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 28 87.5%
split by peak 7 / year
Not applicable: 32 Low: 32 not blocked: 32 No public exploit: 28Working exploit published: 4
19971 Not applicable1 Low1 not blocked1 No public exploit1 19980 19997 Not applicable7 Low7 not blocked7 Working exploit published1 No public exploit6 20000 20014 Not applicable4 Low4 not blocked4 Working exploit published1 No public exploit3 20023 Not applicable3 Low3 not blocked3 No public exploit3 20031 Not applicable1 Low1 not blocked1 Working exploit published1 20041 Not applicable1 Low1 not blocked1 No public exploit1 20051 Not applicable1 Low1 not blocked1 No public exploit1 20061 Not applicable1 Low1 not blocked1 Working exploit published1 20071 Not applicable1 Low1 not blocked1 No public exploit1 20082 Not applicable2 Low2 not blocked2 No public exploit2 20090 20100 20110 20121 Not applicable1 Low1 not blocked1 No public exploit1 20130 20140 20150 20160 20170 20180 20190 20200 20210 20221 Not applicable1 Low1 not blocked1 No public exploit1 20230 20241 Not applicable1 Low1 not blocked1 No public exploit1 20250 20267 Not applicable7 Low7 not blocked7 No public exploit7
1999200220052008201120142017202020232026
32 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-106587 Low 2026-10-06 Not applicable No public exploit In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
CVE-2026-106584 Low 2026-10-06 Not applicable No public exploit In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
CVE-2026-106582 Low 2026-10-06 Not applicable No public exploit In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
CVE-2026-73283 Low 2026-08-11 Not applicable No public exploit In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
CVE-2026-73281 Low 2026-08-11 Not applicable No public exploit In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
CVE-2026-55654 Low 2026-06-23 Not applicable No public exploit A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
CVE-2026-35388 Low 2026-04-02 Not applicable No public exploit OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CVE-2021-35000 Low 2024-05-07 Not applicable No public exploit OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-16112.
CVE-2021-36368 Low 2022-03-13 Not applicable No public exploit An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.
CVE-2011-5000 Low 2012-04-05 Not applicable No public exploit The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.
CVE-2008-5161 Low 2008-11-19 Not applicable No public exploit Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
CVE-2008-3259 Low 2008-07-22 Not applicable No public exploit OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.
CVE-2007-1352 Low 2007-04-06 Not applicable No public exploit Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
CVE-2006-5229 Low 2006-10-10 Not applicable Working exploit published OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
CVE-2005-2666 Low 2005-08-23 Not applicable No public exploit SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
CVE-2004-2230 Low 2004-12-31 Not applicable No public exploit Heap-based buffer overflow in isakmpd on OpenBSD 3.4 through 3.6 allows local users to cause a denial of service (panic) and corrupt memory via IPSEC credentials on a socket.
CVE-2003-1366 Low 2003-12-31 Not applicable Working exploit published chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.
CVE-2002-2280 Low 2002-12-31 Not applicable No public exploit syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
CVE-2002-2092 Low 2002-12-31 Not applicable No public exploit Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
CVE-2002-0701 Low 2002-07-23 Not applicable No public exploit ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
CVE-2001-1029 Low 2001-09-20 Not applicable Working exploit published libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.
CVE-2001-0378 Low 2001-06-27 Not applicable No public exploit readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files.
CVE-2001-1047 Low 2001-06-02 Not applicable No public exploit Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or (2) calling dup2 on a file descriptor in one process, then setting the descriptor to NULL via a close in another process that is created via rfork.
CVE-2000-0309 Low 2001-03-12 Not applicable No public exploit The i386 trace-trap handling in OpenBSD 2.4 with DDB enabled allows a local user to cause a denial of service.
CVE-1999-1010 Low 1999-12-14 Not applicable No public exploit An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.
CVE-2000-0489 Low 1999-09-05 Not applicable Working exploit published FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers.
CVE-1999-0703 Low 1999-08-03 Not applicable No public exploit OpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices.
CVE-1999-0483 Low 1999-02-25 Not applicable No public exploit OpenBSD crash using nlink value in FFS and EXT2FS filesystems.
CVE-1999-0484 Low 1999-02-23 Not applicable No public exploit Buffer overflow in OpenBSD ping.
CVE-1999-0485 Low 1999-02-19 Not applicable No public exploit Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
CVE-1999-0396 Low 1999-02-17 Not applicable No public exploit A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service.
CVE-1999-1214 Low 1997-09-15 Not applicable No public exploit The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.