CVE Program partner
illumos
The illumos project
CVEs, 365 days99 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
| Organisation | The illumos project |
| Role | CNA |
| Type | Open Source |
| Reports to | redhat → mitre |
| Scope | The illumos project’s <a href='https://code.illumos.org/plugins/gitiles/illumos-gate' target='_blank'>illumos-gate repository</a> and related downstream distributions such as <a href='https://openindiana.org' target='_blank'>OpenIndiana</a>, <a href='https://wiki.smartos.org' target='_blank'>SmartOS</a>, and <a href='https://omnios.org' target='_blank'>OmniOS</a>. |
| Advisories | https://illumos.org/docs/security/ |
Latest CVEs · RSS
- CVE-2026-104115 2026-10-09 · CVSS 5.4A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs
- CVE-2026-104114 2026-10-09 · CVSS 5.4A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet
- CVE-2026-104112 2026-10-09 · CVSS 6.8A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, swi
- CVE-2026-104116 2026-10-09 · CVSS 1.9A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to deter
- CVE-2026-104113 2026-10-09 · CVSS 5.4A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies
- CVE-2026-104117 2026-10-09 · CVSS 1.9A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. T
- CVE-2026-102916 2026-10-09 · CVSS 6.8A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that ac
- CVE-2026-15422 2026-07-16 · CVSS 9.1The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since t
- CVE-2026-15449 2026-07-16 · CVSS 5.8A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls