OpenVPN OpenVPN

Name: OpenVPN OpenVPN
Brand: OpenVPN

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

1critical7high3medium0low

updated 2026-10-28

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-10680US	—	7.34% (94th)	—	no fix	2025-10-24	≤ 2.7_alpha1 ≤2.7_beta1
CVE-2025-2704US	—	0.84% (58th)	—	no fix	2025-04-02	≤ 2.6.1 ≤2.6.13
CVE-2024-5594US	—	0.82% (57th)	—	2.6.11	2025-01-06	0 → 2.6.11
CVE-2024-28882US	—	0.66% (52nd)	—	no fix	2024-07-08	≤ 2.6.0 ≤2.6.10
CVE-2025-13086US	high7.5OT elevated	0.64% (51st)	—	no fix	2025-12-03	2 versions
CVE-2025-12106US	—	0.56% (46th)	—	no fix	2025-12-01	≤ 2.7_alpha1 ≤2.7_rc1
CVE-2026-13698US	high7.5	0.55% (46th)	—	no fix	2026-07-06	3 versions
CVE-2026-35058US	medium6.5	0.54% (45th)	—	no fix	2026-06-08	2 versions
CVE-2026-12996US	high8.1	0.46% (40th)	—	no fix	2026-07-30	2 versions
CVE-2026-13122US	medium5.3	0.46% (40th)	—	no fix	2026-07-06	2 versions
CVE-2024-4877US	—	0.44% (38th)	—	no fix	2025-04-03	≤ 2.4.0 ≤2.6.11
CVE-2026-12932US	high8.1	0.42% (36th)	—	no fix	2026-07-30	2 versions
CVE-2026-13117US	high8.1	0.40% (34th)	—	no fix	2026-07-30	2 versions
CVE-2026-11771US	high7.5	0.38% (31st)	—	no fix	2026-07-30	2 versions
CVE-2026-40215US	high7.4	0.37% (31st)	—	no fix	2026-06-08	2 versions
CVE-2025-15497US	—	0.36% (29th)	—	no fix	2026-01-30	≤ 2.7_alpha1 ≤2.7_rc5
CVE-2026-13379US	critical9.1	0.34% (27th)	—	no fix	2026-07-30	≤ 2.7_alpha1 ≤2.7.4
CVE-2026-63649US	—	0.33% (26th)	—	2.7.6	2026-08-14	2 versions
CVE-2026-63650US	—	0.23% (14th)	—	2.7.6	2026-08-14	2.7_alpha1 → 2.7.6
CVE-2023-7235US	—OT elevated	0.21% (12th)	—	no fix	2024-02-21	2 versions
CVE-2025-13751US	medium5.5	0.17% (6th)	—	no fix	2025-12-03	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read3 CVEs
CWE-416Use After Free3 CVEs
CWE-617Reachable Assertion3 CVEs
CWE-401Missing Release of Memory after Effective Lifetime2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-115Misinterpretation of Input1 CVEs
CWE-117Improper Output Neutralization for Logs1 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.