Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
162 results · page 1 of 4
Oct 28, 2026OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect paCVE-2026-115402 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.7
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.CVE-2026-106017 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.3
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
- Product
- OpenVPN 3 Core Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execuCVE-2026-111225 · Other software · Netgate · reported by VulnCheckLow 2.3
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to exCVE-2026-111224 · Other software · Netgate · reported by VulnCheckHigh 7.7
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 14, 2026The fix for CVE-2026-12996 was incomplete.CVE-2026-84471 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.2
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memoCVE-2026-88964 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.1
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadloCVE-2026-105390 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.9
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldCVE-2026-84790 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.6
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via craftCVE-2026-82325 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.8
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs thatCVE-2026-84732 · Other software · OpenVPN · reported by security@openvpn.netHigh 8.7
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commCVE-2026-84256 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.7
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during networkCVE-2026-84226 · Other software · OpenVPN · reported by security@openvpn.netHigh 8.5
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC CVE-2026-82312 · Other software · OpenVPN · reported by security@openvpn.netLow 1.8
OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via inCVE-2026-81830 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.6
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entriesCVE-2026-81738 · Other software · OpenVPN · reported by security@openvpn.netLow 2.3
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corCVE-2026-78221 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.9
An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint anCVE-2026-78043 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.6
The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient valCVE-2026-19586 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Critical 9.3
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
- Product
- ER7212PC v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattg.systemsomadanetworks.com
Aug 14, 2026OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup fCVE-2026-63650 · Other software · OpenVPN · reported by security@openvpn.netLow 2
OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Aug 14, 2026The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuratioCVE-2026-63649 · Other software · OpenVPN · reported by security@openvpn.netMedium 4.1
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Aug 13, 2026luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arCVE-2026-72841 · Other software · openwrt · reported by VulnCheckCritical 9.4
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
- Product
- luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 8, 2026MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbCVE-2026-71993 · Other software · MSI · reported by VulnCheckCritical 9.3
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.
- Product
- Radix AXE6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a craCVE-2026-13379 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.1
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jul 30, 2026An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS sessioCVE-2026-13117 · Other software · OpenVPN · reported by security@openvpn.netMedium 6
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jul 30, 2026A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leakCVE-2026-12996 · Other software · OpenVPN · reported by security@openvpn.netMedium 6
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jul 30, 2026A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial oCVE-2026-12932 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.1
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jul 30, 2026OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentiallCVE-2026-11771 · Other software · OpenVPN · reported by security@openvpn.netHigh 7
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jul 8, 2026OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smugglinCVE-2025-3110 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.9
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy
- Product
- Access Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token thatCVE-2026-13122 · Other software · Openvpn · reported by security@openvpn.netMedium 5.9
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 clienCVE-2026-13698 · Other software · OpenVPN · reported by security@openvpn.netMedium 6
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameteCVE-2026-58000 · Other software · openwrt · reported by VulnCheckHigh 8.7
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.
- Product
- luci-proto-openvpn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to triggeCVE-2026-11604 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.6
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netgithub.com
Jun 8, 2026A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory viCVE-2026-40215 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.1
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
Jun 8, 2026Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackCVE-2026-35058 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.9
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netcommunity.openvpn.net
May 26, 2026Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileCVE-2026-9560 · Other software · OpenVPN Inc · reported by security@openvpn.netCritical 9.4
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- Product
- OpenVPN Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows.CVE-2026-41070 · Other software · jkroepke · reported by GitHubCritical 10
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.
- Product
- openvpn-auth-oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Tunnelblick is an open source graphic user interface for OpenVPN on macOS.CVE-2026-31893 · Other software · Tunnelblick · reported by GitHubMedium 6.8
Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02.
- Product
- Tunnelblick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC.CVE-2024-1490 · Other software · WAGO · reported by info@cert.vde.comHigh 7.2
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
- Product
- CC100 (0751-9x01)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comwago.csaf-tp.certvde.com
Apr 8, 2026An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files wheCVE-2026-30817 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.8
An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
- Product
- AX53 v1.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtp-link.com
Apr 8, 2026An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file wCVE-2026-30816 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.8
An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
- Product
- AX53 v1.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtp-link.com
Apr 8, 2026An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands wheCVE-2026-30815 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.5
An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity. This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
- Product
- AX53 v1.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtp-link.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi.CVE-2026-34819 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
- Product
- Endian Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.endian.comvulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi.CVE-2026-34796 · Other software · Endian · reported by VulnCheckHigh 8.7
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
- Product
- Endian Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.endian.comvulncheck.com
Feb 19, 2026Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag aCVE-2026-2738 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.6
Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoint that allow attackers to inject malicioCVE-2019-25428 · Other software · Comodo · reported by VulnCheckMedium 5.1
Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoint that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted POST requests with script payloads in the username, remotenets, explicitroutes, static_ip, custom_dns, or custom_domain parameters to execute arbitrary JavaScript in users' browsers.
- Product
- Comodo Dome Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdome.comodo.comsecure.comodo.com
Jan 30, 2026Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of serCVE-2025-15497 · Other software · OpenVPN · reported by security@openvpn.netLow 3.8
Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Dec 3, 2025Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a diCVE-2025-13086 · Other software · OpenVPN · reported by security@openvpn.netMedium 4.6
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Dec 3, 2025Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the CVE-2025-13751 · Other software · OpenVPN · reported by security@openvpn.netLow 1.3
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Dec 1, 2025Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addressesCVE-2025-12106 · Other software · OpenVPN · reported by security@openvpn.netCritical 9.1
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Oct 27, 2025Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML CVE-2025-50055 · Other software · OpenVPN · reported by security@openvpn.netMedium 6.4
Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter
- Product
- Access Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.