How many CVEs does FreeBSD have?

FreeBSD has 648 published CVE records since 1999, including 83 in the last two years.

How many FreeBSD CVEs are in CISA KEV?

None of FreeBSD's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which FreeBSD products have the most CVEs?

The FreeBSD products with the most published CVEs are FreeBSD, libarchive, fetch, FreeBSD 12.4-RELEASE, FreeBSD 13.1-RELEASE.

What are the most common weakness types in FreeBSD CVEs?

FreeBSD's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-264, CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Are there public exploits for FreeBSD vulnerabilities?

Yes — 172 of FreeBSD's CVEs have a known public exploit.

How many critical FreeBSD vulnerabilities are there?

FreeBSD has 67 critical and 276 high-severity CVEs.

What is the average severity of FreeBSD CVEs?

The average CVSS base score across FreeBSD's scored CVEs is 6.5.

FreeBSD Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: FreeBSD vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

FreeBSD has 648 published CVE records since 1999, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 172 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

Security scorecard

A quick read on FreeBSD's vulnerability posture, as a share of its 648 published CVEs.

Average CVSS: 6.5
Critical / high: 53%
Actively exploited (KEV): 0%
Public exploit available: 27%
Patch available: 41%

Severity and exploitation

How the CVSS severity of FreeBSD's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical67

High276

Medium233

Low69

3 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

None of FreeBSD's CVEs are currently listed in CISA's KEV catalog.

Public exploits

172

172 of FreeBSD's CVEs have a known public exploit available.

Most affected products

The FreeBSD products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in FreeBSD CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish FreeBSD CVE records.

Disclosure activity by year

How many FreeBSD CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest FreeBSD CVEs

The most recently disclosed vulnerabilities affecting FreeBSD.

Multiple vulnerabilities in bhyve device models
CWE-362
High · CVSS 7.0
EPSS 0.1%2026-10-15
Multiple vulnerabilities in bhyve device models
CWE-126
High · CVSS 7.0
EPSS 0.1%2026-10-15
Multiple vulnerabilities in bhyve device models
CWE-362
High · CVSS 7.0
EPSS 0.1%2026-10-15
TOCTOU race between sound(4) buffer resizing and mmap

Other vendors

CVE counts for other vendors.

openclaw680 CVEs Novell678 CVEs Mattermost663 CVEs UNISOC661 CVEs Moodle645 CVEs TP-Link637 CVEs campcodes632 CVEs GNOME616 CVEs

Browse all vendors

Frequently asked questions

Common questions about FreeBSD vulnerabilities.

How many CVEs does FreeBSD have?: FreeBSD has 648 published CVE records since 1999, including 83 in the last two years.
How many FreeBSD CVEs are in CISA KEV?: None of FreeBSD's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which FreeBSD products have the most CVEs?: The FreeBSD products with the most published CVEs are FreeBSD, libarchive, fetch, FreeBSD 12.4-RELEASE, FreeBSD 13.1-RELEASE.
What are the most common weakness types in FreeBSD CVEs?: FreeBSD's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-264, CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for FreeBSD vulnerabilities?: Yes — 172 of FreeBSD's CVEs have a known public exploit.
How many critical FreeBSD vulnerabilities are there?: FreeBSD has 67 critical and 276 high-severity CVEs.
What is the average severity of FreeBSD CVEs?: The average CVSS base score across FreeBSD's scored CVEs is 6.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track FreeBSD vulnerabilities

Get an alert for each new FreeBSD CVE, with AI-written analysis and remediation steps.

Create an account See pricing