FR
Product
FreeBSD
595
CVEs
0
On KEV
10.0
Max CVSS
13
New 30D
Severity mix
Critical 35High 168Medium 83Low 9
Watch
Add FreeBSD to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7270 | 7.8 | Apr 30 | Local privilege escalation via execve() Affected: 15.0-RELEASE before p7; 14.4-RELEASE before p3; 14.3-RELEASE before p12; 13.5-RELEASE before p13 |
| CVE-2022-23086 | 7.8 | Feb 15 | mpr/mps/mpt driver ioctl heap out-of-bounds write Affected: 13.1-RC1 before p1; 13.0-RELEASE before p11; 12.3-RELEASE before p5 |
| CVE-2021-29631 | 7.8 | Aug 30 | In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE… Affected: 11.4; 11.4; 11.4; 11.4; 11.4; 11.4; +23 more |
| CVE-2021-29627 | 7.8 | Apr 7 | In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing the accf_create… Affected: 12.0 before 12.2; 12.2; 12.2; 12.2; 13.0; 13.0; +5 more |
| CVE-2019-15878 | 7.8 | May 13 | In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper… Affected: 11.3; 11.3; 11.3; 11.3; 11.3; 11.3; +4 more |
| CVE-2020-10566 | 7.8 | Mar 14 | grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow Affected: before 525916_2020-02-12 |
| CVE-2020-10565 | 7.8 | Mar 14 | grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a… Affected: before 525916_2020-02-12 |
| CVE-2012-4576 | 7.8 | Dec 2 | FreeBSD: Input Validation Flaw allows local users to gain elevated privileges Affected: 7.4; 8.3; 9.0; 9.1 |
| CVE-2019-5607 | 7.8 | Jul 26 | In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before… Affected: 11.0; 11.2; 11.3; 12.0 |
| CVE-2019-5606 | 7.8 | Jul 26 | In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before… Affected: 11.0; 11.2; 11.3; 12.0 |
| CVE-2019-5603 | 7.8 | Jul 26 | In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before… Affected: 11.0; 11.2; 11.2; 11.2; 11.2; 11.2; +16 more |
| CVE-2017-1085 | 7.8 | Sep 12 | In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region Affected: before 11.2 |
| CVE-2018-8897 | 7.8 | May 8 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all… Affected: 11.0 before 11.1 |
| CVE-2015-1418 | 7.8 | Feb 5 | The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and… Affected: 10.1; 10.2 |
| CVE-2015-1416 | 7.8 | Feb 5 | Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other… Affected: 10.0; 10.1; 10.2 |
| CVE-2017-1087 | 7.8 | Nov 16 | In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and modify the content of… Affected: FreeBSD 10.x |
| CVE-2015-5675 | 7.8 | Oct 10 | The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic) Affected: 9.3; 10.1 |
| CVE-2016-1889 | 7.8 | Feb 15 | Integer overflow in the bhyve hypervisor in FreeBSD 10.1, 10.2, 10.3, and 11.0 when configured with a large amount of guest memory, allows local users to gain privilege via a… Affected: 10.1; 10.2; 10.3; 11.0 |
| CVE-2016-1883 | 7.8 | Feb 15 | The issetugid system call in the Linux compatibility layer in FreeBSD 9.3, 10.1, and 10.2 allows local users to gain privilege via unspecified vectors Affected: 9.3; 10.1; 10.2 |
| CVE-2016-1881 | 7.8 | Feb 15 | The kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibility layer setgroups… Affected: 9.3; 10.1; 10.2 |
| CVE-2016-1880 | 7.8 | Feb 15 | The Linux compatibility layer in the kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to read portions of kernel memory and potentially gain privilege via unspecified… Affected: 9.3; 10.1; 10.2 |
| CVE-2016-1887 | 7.8 | May 25 | Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial… Affected: 10.1; 10.2; 10.3 |
| CVE-2016-1886 | 7.8 | May 25 | Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users… Affected: 9.3; 10.1; 10.2; 10.3 |
| CVE-2010-4210 | 7.8 | Nov 20 | The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked, which allows local users to cause a denial of… Affected: 7.0 before 7.3; 8.0; 8.0; 8.0; 8.0; 8.0; +1 more |
| CVE-2006-6165 | 7.8 | Nov 29 | ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing… Affected: 6.2 |
| CVE-2005-1036 | 7.8 | May 2 | FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO permission bitmap used to allow user access to certain hardware, which allows local users to bypass intended access… Affected: 5.0 through 5.4 |
| CVE-1999-0022 | 7.8 | Jul 3 | Local user gains root privileges via buffer overflow in rdist, via expstr() function Affected: 2.0; 2.0.5; 2.1.0 |
| CVE-2022-23090 | 7.7 | Feb 15 | AIO credential reference count leak Affected: 13.1-RELEASE before p1; 13.0-RELEASE before p12; 12.3-RELEASE before p6 |
| CVE-2020-7467 | 7.6 | Mar 26 | In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD virtualization… Affected: 11.3; 11.3; 11.3; 11.3; 11.3; 11.3; +23 more |
| CVE-2026-101303 | 7.5 | Oct 15 | IPv6 UDP sendto(2) bypasses jail loopback restriction Affected: 15.1-RELEASE before p4; 15.0-RELEASE before p14; 14.5-RELEASE before p1; 14.4-RELEASE before p10 |
| CVE-2026-58085 | 7.5 | Aug 19 | Missing MAC validation in wg(4) packet decryption Affected: 15.1-RELEASE before p2; 15.0-RELEASE before p12; 14.4-RELEASE before p8 |
| CVE-2026-45255 | 7.5 | May 21 | Remote code execution via installer Wi-Fi access point scans Affected: 15.0-RELEASE before p9; 14.4-RELEASE before p5; 14.3-RELEASE before p14 |
| CVE-2026-7164 | 7.5 | Apr 30 | pf can overflow the stack parsing crafted SCTP packets Affected: 15.0-RELEASE before p7; 14.4-RELEASE before p3; 14.3-RELEASE before p12; 13.5-RELEASE before p13 |
| CVE-2026-4748 | 7.5 | Apr 1 | pf silently ignores certain rules Affected: 15.0-RELEASE before p5; 14.4-RELEASE before p1; 14.3-RELEASE before p10 |
| CVE-2026-4652 | 7.5 | Mar 26 | Remote denial of service via null pointer dereference Affected: 15.0-RELEASE before p5 |
| CVE-2026-4247 | 7.5 | Mar 26 | TCP: remotely exploitable DoS vector (mbuf leak) Affected: 15.0-RELEASE before p5; 14.4-RELEASE before p1; 14.3-RELEASE before p10 |
| CVE-2026-3038 | 7.5 | Mar 9 | Local DoS and possible privilege escalation via routing sockets Affected: 15.0-RELEASE before p4; 14.3-RELEASE before p9; 13.5-RELEASE before p10; 14.4-RC1 |
| CVE-2026-2261 | 7.5 | Mar 9 | blocklistd(8) socket leak Affected: 15.0-RELEASE before p3 |
| CVE-2025-15576 | 7.5 | Mar 9 | Jail chroot escape via fd exchange with a different jail Affected: 14.3-RELEASE before p9; 13.5-RELEASE before p10 |
| CVE-2025-14769 | 7.5 | Mar 9 | ipfw denial of service Affected: 14.3-RELEASE before p7; 13.5-RELEASE before p8 |
| CVE-2024-45289 | 7.5 | Nov 12 | Unbounded allocation in ctl(4) CAM Target Layer Affected: 14.1-RELEASE before p6; 13.4-RELEASE before p2; 13.3-RELEASE before p8 |
| CVE-2024-51564 | 7.5 | Nov 12 | bhyve(8) infinite loop in the hda audio driver Affected: 14.1-RELEASE before p6; 13.4-RELEASE before p2; 13.3-RELEASE before p8 |
| CVE-2024-45287 | 7.5 | Sep 5 | Multiple vulnerabilities in libnv Affected: 14.1-RELEASE before p4; 14.0-RELEASE before p10; 13.3-RELEASE before p6 |
| CVE-2024-6760 | 7.5 | Aug 11 | ktrace(2) fails to detach when executing a setuid binary Affected: 14.1-RELEASE before p3; 14.0-RELEASE before p9; 13.3-RELEASE before p5 |
| CVE-2022-23084 | 7.5 | Feb 15 | Potential jail escape vulnerabilities in netmap Affected: 13.1-RC1 before p1; 13.0-RELEASE before p11; 12.3-RELEASE before p5 |
| CVE-2023-6534 | 7.5 | Dec 13 | TCP spoofing vulnerability in pf(4) Affected: 14.0-RELEASE before p2; 13.2-RELEASE before p7; 12.4-RELEASE before p9 |
| CVE-2023-5978 | 7.5 | Nov 8 | Incorrect libcap_net limitation list manipulation Affected: 13.2-RELEASE before p5 |
| CVE-2023-4809 | 7.5 | Sep 6 | pf incorrectly handles multiple IPv6 fragment headers Affected: 13.2-RELEASE before p3; 12.4-RELEASE before p5 |
| CVE-2023-3107 | 7.5 | Aug 1 | Remote denial of service in IPv6 fragment reassembly Affected: 13.2-RELEASE before 13.2-RELEASE-p2; 13.1-RELEASE before 13.1-RELEASE-p9; 12.4-RELEASE before 12.4-RELEASE-p4 |
| CVE-2022-32264 | 7.5 | Sep 6 | sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connections Affected: before 7.0 |
The 500 most important CVEs for this product (exploited first, then by severity)