Veille CVE

Juillet 2026

9 CVE

Critique 1 Élevée 6 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenVPN » ✕
  1. CVE-2026-13379 9.1 Critique

    OpenVPN · Openvpn openvpn

    The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

  2. CVE-2026-13117 8.1 Élevée

    OpenVPN · Openvpn openvpn

    An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

  3. CVE-2026-12996 8.1 Élevée

    OpenVPN · Openvpn openvpn · Debian debian linux

    A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

  4. CVE-2026-12932 8.1 Élevée

    OpenVPN · Openvpn openvpn

    A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

  5. CVE-2026-11771 7.5 Élevée

    OpenVPN · Openvpn openvpn

    OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

  6. CVE-2026-15204 5.3 Moyenne

    TOTOLINK X5000R

    A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely.

  7. CVE-2025-3110 7.5 Élevée

    OpenVPN Access Server · Openvpn openvpn access server

    OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

  8. CVE-2026-13122 5.3 Moyenne

    OpenVPN · Openvpn openvpn

    OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

  9. CVE-2026-13698 7.5 Élevée

    OpenVPN · Openvpn openvpn

    A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service