CO
Product
Connect
8
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 1Low 0
Watch
Add Connect to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9560 | 7.8 | May 26 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC… Affected: 3.5.1 before 3.8.2 |
| CVE-2023-7245 | 7.8 | Feb 20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the… Affected: 3.2.0 before 3.4.4; 3.2.0 before 3.4.8; 3.0.0; 3.0.0; 3.0.1; 3.0.2; +6 more |
| CVE-2023-7224 | 7.8 | Jan 8 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable Affected: 3.0.0 through 3.4.6 |
| CVE-2021-3613 | 7.8 | Jul 2 | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run… Affected: 3.2.0 through 3.3.0 |
| CVE-2020-9442 | 7.8 | Feb 28 | OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a… Affected: through 3.1.0.361 |
| CVE-2024-8474 | 7.5 | Jan 6 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to… Affected: before 3.5.0 |
| CVE-2020-15075 | 7.1 | Mar 30 | OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp Affected: through 3.2.6 |
| CVE-2022-3761 | 5.9 | Oct 17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download… Affected: before 3.4.0.3121; before 3.4.0.4506 |
Showing 8