Veille CVE

Semaine du 10 août au 16 août 2026

3 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenVPN » ✕
  1. CVE-2026-63650 2.0 Faible

    OpenVPN

    OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

  2. CVE-2026-63649 4.1 Moyenne

    OpenVPN

    The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks

  3. CVE-2026-72841 9.9 Critique

    openwrt luci

    luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.