Vendor

OpenBSD

No CISA KEV deadline is open. CISA last added a OpenBSD CVE on 25 Mar 2022.

Tracked since 27 Apr · latest article Wed 8 Jul · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 1 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2020-7247not in CyberSIXT coverageOpenSMTPD25 Mar 2022Deadline passed 15 Apr 2022Ransomware: Unknown · 0 articles

Products

3 products · 3 CVEs in coverage

OpenSMTPD0 CVEs · 1 in KEV OpenSSH2 CVEs · 0 in KEVlatest 8 Jul

Several products1 CVEs · 0 in KEVlatest 19 Jun

Trends

Added to CISA KEV per quarter

Q1 2025Q4 2026

Show as table

Added to CISA KEV per quarter
Period	Count
Q1 2025	0
Q2 2025	0
Q3 2025	0
Q4 2025	0
Q1 2026	0
Q2 2026	0
Q3 2026	0
Q4 2026	0

CVEs in coverage by publication month

Publication dates are still being collected (0 of 3).

FIRST EPSS percentiles across CVEs in coverage

05095 · 100th percentile

Show as table

FIRST EPSS percentiles across CVEs in coverage
CVE	EPSS percentile
CVE-2026-55706	28.8
CVE-2026-60002	22.5
CVE-2026-35414	11.7

Fix listed for 3 of 3 CVEs in coverage.

Coverage

3 articles · all timeFull timeline →

Three articles so far, 27 Apr to 8 Jul.

1 2 3

Mon 27 Apr · first reportOpenSSH flaw grants root via comma in certificate principalSecurityWeek
Fri 19 JunOpenBSD vulnerability allows auth bypass using empty credentialsSecurityOnline
Wed 8 JulOpenSSH 10.4 fixes critical CVE-2026-60002 and other bugsSecurityOnline

See the full timeline

8 JulOpenSSH 10.4 fixes critical CVE-2026-60002 and other bugsSecurityOnline
19 JunOpenBSD vulnerability allows auth bypass using empty credentialsSecurityOnline
27 AprOpenSSH flaw grants root via comma in certificate principalSecurityWeek

All CVEs in coverage

CVE-2026-55706OpenBSD vulnerabilityCVSS5.8Medium–Not in KEV0.3%EPSS1article

CVE-2026-60002OpenBSD OpenSSH vulnerabilityCVSS7.7High–Not in KEV0.3%EPSS1article

CVE-2026-35414OpenBSD OpenSSH vulnerabilityCVSS4.2Medium–Not in KEV0.2%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

OpenBSD

Exploited, by due date

Products

Trends

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts