How many CVEs does openbsd have?

openbsd has 378 published CVE records since 1999, including 44 in the last two years.

How many openbsd CVEs are in CISA KEV?

Yes — 1 of openbsd's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which openbsd products have the most CVEs?

The openbsd products with the most published CVEs are OpenBSD, OpenSSH, src, libressl, opensmtpd.

What are the most common weakness types in openbsd CVEs?

openbsd's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-287 (Improper Authentication).

Are there public exploits for openbsd vulnerabilities?

Yes — 138 of openbsd's CVEs have a known public exploit.

How many critical openbsd vulnerabilities are there?

openbsd has 47 critical and 126 high-severity CVEs.

What is the average severity of openbsd CVEs?

The average CVSS base score across openbsd's scored CVEs is 6.4.

openbsd Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: openbsd vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

openbsd has 378 published CVE records since 1999, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 138 have a known public exploit. The average CVSS base score across scored CVEs is 6.4.

Security scorecard

A quick read on openbsd's vulnerability posture, as a share of its 378 published CVEs.

Average CVSS: 6.4
Critical / high: 46%
Actively exploited (KEV): 0%
Public exploit available: 37%
Patch available: 49%

Severity and exploitation

How the CVSS severity of openbsd's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical47

High126

Medium168

Low37

In CISA’s Known Exploited Vulnerabilities catalog

One of openbsd's CVEs is confirmed exploited in the wild.

Public exploits

138

138 of openbsd's CVEs have a known public exploit available.

Most affected products

The openbsd products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in openbsd CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish openbsd CVE records.

Disclosure activity by year

How many openbsd CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest openbsd CVEs

The most recently disclosed vulnerabilities affecting openbsd.

High vulnerability · 2026-10-06
CWE-99
High · CVSS 7.8
EPSS 0.2%2026-10-06
Low vulnerability · 2026-10-06
CWE-272
Low · CVSS 2.9
EPSS 0.1%2026-10-06
Low vulnerability · 2026-10-06
CWE-653
Low · CVSS 3.1
EPSS 0.1%2026-10-06
Low vulnerability · 2026-10-06
CWE-843

Other vendors

CVE counts for other vendors.

Advantech404 CVEs Elastic396 CVEs nextcloud393 CVEs Autodesk385 CVEs Irfanview385 CVEs Synology375 CVEs Asus369 CVEs WWBN354 CVEs

Browse all vendors

Frequently asked questions

Common questions about openbsd vulnerabilities.

How many CVEs does openbsd have?: openbsd has 378 published CVE records since 1999, including 44 in the last two years.
How many openbsd CVEs are in CISA KEV?: Yes — 1 of openbsd's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which openbsd products have the most CVEs?: The openbsd products with the most published CVEs are OpenBSD, OpenSSH, src, libressl, opensmtpd.
What are the most common weakness types in openbsd CVEs?: openbsd's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-287 (Improper Authentication).
Are there public exploits for openbsd vulnerabilities?: Yes — 138 of openbsd's CVEs have a known public exploit.
How many critical openbsd vulnerabilities are there?: openbsd has 47 critical and 126 high-severity CVEs.
What is the average severity of openbsd CVEs?: The average CVSS base score across openbsd's scored CVEs is 6.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track openbsd vulnerabilities

Get an alert for each new openbsd CVE, with AI-written analysis and remediation steps.

Create an account See pricing