Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 09:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

185-69% vs 7-day avg of 598

2 critical, 69 high, 71 medium, 33 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.3	CVE-2026-106017	Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions. OpenVPNOpenVPN 3 Core Library	NVD	Oct 22 10:17 UTC
CVE-2026-106017Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions. Executive summary The advisory says the OpenVPN 3 Core library, versions 3.4 through 3.11.7, contains a certificate validation flaw that lets an attacker impersonate a VPN server. The vendor's fix is OpenVPN 3 Core Library v3.11.8, and the advisory does not state a severity score. Technical summary The flaw is improper certificate validation in the profile option parser (KUParse) of the OpenVPN 3 Core library, versions 3.4 through 3.11.7, which allows extended key usage restrictions to be bypassed. A man-in-the-middle attacker who holds any certificate issued by the client's configured CA, and whose certificate lacks a serverAuth extended key usage, can impersonate the VPN server, because remote-cert-tls from a client profile is silently discarded during configuration load. The fixed version is OpenVPN 3 Core Library v3.11.8. The advisory does not state a CVSS score, a workaround, exploitation in the wild, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from community.openvpn.net/Security%20Announ…ents/CVE-2026-106017 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects OpenVPN OpenVPN 3 Core Library NIST National Vulnerability DatabasePublished Oct 22, 2026 10:17 UTC Read the advisory
	High	7.2	CVE-2026-84471	The fix for CVE-2026-12996 was incomplete OpenVPNOpenVPN	NVD	Oct 14 15:17 UTC
CVE-2026-84471The fix for CVE-2026-12996 was incomplete From the advisory The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects OpenVPN OpenVPN NIST National Vulnerability DatabasePublished Oct 14, 2026 15:17 UTC Read the advisory
	High	7.1	CVE-2026-88964	An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure... OpenVPNOpenVPN	NVD	Oct 13 23:19 UTC
CVE-2026-88964An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure... From the advisory An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options Impact if exploited ConfidentialityLow IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects OpenVPN OpenVPN NIST National Vulnerability DatabasePublished Oct 13, 2026 23:19 UTC Read the advisory
	Medium	6.9	CVE-2026-105390	Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted... OpenVPNOpenVPN ovpn-dco-win	NVD	Oct 13 23:17 UTC
CVE-2026-105390Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted... From the advisory Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects OpenVPN OpenVPN ovpn-dco-win NIST National Vulnerability DatabasePublished Oct 13, 2026 23:17 UTC Read the advisory
	High	7.6	CVE-2026-84790	OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field OpenVPNOpenVPN	NVD	Oct 13 22:18 UTC
CVE-2026-84790OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field From the advisory OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects OpenVPN OpenVPN NIST National Vulnerability DatabasePublished Oct 13, 2026 22:18 UTC Read the advisory
	Medium	n/a	USN-8953-1	OpenVPN vulnerability Canonical, OpenVPNCanonical Ubuntu Linux, OpenVPN, Canonical Ubuntu	Ubuntu Security Notices	Oct 22 15:38 UTC
USN-8953-1CVE-2026-84790OpenVPN vulnerability Executive summary Canonical's Ubuntu Security Team published notice USN-8953-1 about a flaw in OpenVPN, the virtual private network software, which could allow unintended access to network services. The notice says a remote authenticated user could possibly use the issue to impersonate other users. The recommended fix is to update the openvpn package to the fixed version for your Ubuntu release and then restart OpenVPN. Technical summary The flaw is described as OpenVPN incorrectly handling certificate subject fields, which the advisory presents as an impersonation issue exploitable by a remote authenticated user. The advisory does not state a CVSS score, and the attack preconditions beyond remote authentication are not stated. Fixed package versions are listed as openvpn 2.7.7-1ubuntu1.1 for 26.10 (stonking), 2.7.0-1ubuntu1.4 for 26.04 LTS (resolute), 2.6.19-0ubuntu0.24.04.5 for 24.04 LTS (noble), and 2.5.11-0ubuntu0.22.04.6 for 22.04 LTS (jammy). The advisory identifies CVE-2026-84790 and says that a restart of OpenVPN is needed after the update. No workarounds, affected version ranges, or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8953-1 Score No CVSS score published. Affects Canonical OpenVPN Canonical Ubuntu Linux OpenVPN Canonical Ubuntu Canonical Ubuntu Security TeamPublished Oct 22, 2026 15:38 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee