CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,273 CVEs published, 266 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,273
Show in the list
Critical, last 7 days
266
Show in the list
Healthcare-tagged, last 7 days
10
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product openvpn:openvpn. Show all products

27 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2025-10680High 8.8OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use
Assigned by OpenVPN
Oct 24, 2025
CVE-2025-12106Critical 9.1Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
Assigned by OpenVPN
Dec 1, 2025
CVE-2025-13751Low 1.3Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a…
Assigned by OpenVPN
Dec 3, 2025
CVE-2025-13086Medium 4.6Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initia…
Assigned by OpenVPN
Dec 3, 2025
CVE-2025-15497Low 3.8Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service
Assigned by OpenVPN
Jan 30, 2026
CVE-2026-35058Medium 6.9Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and ca…
Assigned by OpenVPN
Jun 8, 2026
CVE-2026-40215Medium 6.1A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS…
Assigned by OpenVPN
Jun 8, 2026
CVE-2026-13698Medium 6.0A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of…
Assigned by OpenVPN
Jul 6, 2026
CVE-2026-13122Medium 5.9OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when ex…
Assigned by OpenVPN
Jul 6, 2026
CVE-2026-13379Medium 5.1The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnec…
Assigned by OpenVPN
Jul 30, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.