Aggregating NVD, CVE, and multi-source threat feeds, this list provides deep analysis of high-risk threats such as RCE. By integrating CVSS and EPSS models, the system dynamically tracks Exp (Exploit) resources and PoC availability to accurately assess Exploitability. Combined with official Patches and remediation strategies, it helps prioritize Vulnerability Management workflows, significantly shortening response cycles and securing your critical assets.
Assigner (CNA / source)：[email protected] Remove this filter
| CVE | Description | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|
| CVE-2025-3110 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy | 6.9 | 0.31% | 2026-07-08 | 2026-07-10 |
| CVE-2026-13122 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled | 5.9 | 0.47% | 2026-07-06 | 2026-07-09 |
| CVE-2026-13698 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | 6.0 | 0.52% | 2026-07-06 | 2026-07-09 |
| CVE-2026-11604 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service). | 5.6 | 0.08% | 2026-06-10 | 2026-06-17 |
| CVE-2026-40215 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion. | 6.1 | 0.31% | 2026-06-08 | 2026-06-17 |
| CVE-2026-35058 | Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet. | 6.9 | 0.32% | 2026-06-08 | 2026-06-17 |
| CVE-2026-9560 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel | 9.4 | 0.57% | 2026-05-26 | 2026-06-17 |
| CVE-2026-2738 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet | 5.6 | 0.11% | 2026-02-19 | 2026-06-17 |
| CVE-2025-15497 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service | 3.8 | 0.32% | 2026-01-30 | 2026-06-17 |
| CVE-2025-13086 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client | 4.6 | 0.61% | 2025-12-03 | 2026-06-17 |
| CVE-2025-13751 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service. | 1.3 | 0.15% | 2025-12-03 | 2026-06-17 |
| CVE-2025-12106 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | 9.1 | 0.53% | 2025-12-01 | 2026-06-17 |
| CVE-2025-50055 | Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter | 6.4 | 0.18% | 2025-10-27 | 2026-06-17 |
| CVE-2025-10680 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use | 8.8 | 6.93% | 2025-10-24 | 2026-06-17 |
| CVE-2025-50054 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash | 5.5 | 0.22% | 2025-06-20 | 2026-06-17 |
| CVE-2025-3908 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory. | 6.2 | 0.18% | 2025-05-19 | 2026-06-17 |
| CVE-2024-4878 | Rejected reason: Unused CVE record, incorrectly reserved | N/A | N/A | 2025-05-19 | 2025-05-19 |
| CVE-2024-4877 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges | 8.8 | 0.41% | 2025-04-03 | 2026-06-17 |
| CVE-2025-2704 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase | 7.5 | 0.78% | 2025-04-02 | 2026-06-17 |
| CVE-2024-13454 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3 | 5.3 | 0.08% | 2025-01-20 | 2026-06-17 |