Freebsd - vulnerabilities (CVEs)

612 CVEs in 14 products, 13 in the last 30 days, newest from 2026-10-15.

Products

Freebsd - 585 CVEs
Libarchive - 7 CVEs
Advanced Intrusion Detection Environment - 1 CVEs
Cvsweb - 1 CVEs
Fetch - 1 CVEs
Freebsd-sendpr - 1 CVEs
Heimdal - 1 CVEs
Ja-xklock - 1 CVEs
Libfetch - 1 CVEs
Name Server Daemon - 1 CVEs
Point-to-point Protocol Daemon - 1 CVEs
Ports Collection - 1 CVEs
Slashem-tty - 1 CVEs
Aide - 0 CVEs

Newest CVEs of Freebsd

CVE-2026-101311 - CVSS 7 (high), 2026-10-15: The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally,…
CVE-2026-101310 - CVSS 7 (high), 2026-10-15: The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an…
CVE-2026-101309 - CVSS 7 (high), 2026-10-15: The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and…
CVE-2026-101308 - CVSS 5.5 (medium), 2026-10-15: When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to…
CVE-2026-101307 - CVSS 9.1 (critical), 2026-10-15: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting…
CVE-2026-101303 - CVSS 7.5 (high), 2026-10-15: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A…
CVE-2026-101302 - CVSS 6.5 (medium), 2026-10-15: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the…
CVE-2026-101306 - CVSS 9.8 (critical), 2026-10-15: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the…
CVE-2026-101305 - CVSS 8.8 (high), 2026-10-15: renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then…
CVE-2026-101304 - CVSS 7.1 (high), 2026-10-15: When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum…
CVE-2026-58100 - CVSS 7 (high), 2026-10-15: kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's…
CVE-2026-58099 - CVSS 7 (high), 2026-10-15: When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position)…
CVE-2026-58098 - CVSS 8.4 (high), 2026-10-15: When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the…
CVE-2026-58094 - CVSS 7.8 (high), 2026-08-26: The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the…
CVE-2026-58093 - CVSS 7 (high), 2026-08-26: The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the…
CVE-2026-58097 - CVSS 7.8 (high), 2026-08-26: mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user…
CVE-2026-58096 - CVSS 8.8 (high), 2026-08-26: LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would…
CVE-2026-58095 - CVSS 8.8 (high), 2026-08-26: mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow…
CVE-2026-58092 - CVSS 8.1 (high), 2026-08-26: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array…
CVE-2026-58091 - CVSS 7.8 (high), 2026-08-26: The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list…
CVE-2026-58090 - CVSS 7.8 (high), 2026-08-26: The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some…
CVE-2026-58089 - CVSS 7.8 (high), 2026-08-26: When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check…
CVE-2026-58088 - CVSS 7.4 (high), 2026-08-19: The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a…
CVE-2026-58087 - CVSS 7.8 (high), 2026-08-19: The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized…
CVE-2026-58086 - CVSS 8.1 (high), 2026-08-19: As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was…
CVE-2026-58085 - CVSS 7.5 (high), 2026-08-19: After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The…
CVE-2026-58084 - CVSS 5.5 (medium), 2026-08-19: To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI…
CVE-2026-58083 - CVSS 8.4 (high), 2026-08-19: While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was…
CVE-2026-58082 - CVSS 9.8 (critical), 2026-08-19: The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10…
CVE-2026-58081 - CVSS 9.8 (critical), 2026-08-19: Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted…