Login Request a demo
TO
Product
Tor
by torproject · last CVE Aug 20, 2026
On CISA KEVExploited in the wild
48
CVEs
1
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities48In the news0Timeline
Severity mix
Critical 4High 27Medium 10Low 0
Severity
All severities48Critical4High27Medium10Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Tor to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2016-9079
In wildKEV
7.5
87%
Jun 11
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Affected: All versions, or not specified
CVE-2026-77641
8.2
0%
Aug 20
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails
Affected: 0.4.8.1-alpha before 0.4.9.9
CVE-2026-77584
8.2
0%
Aug 20
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams
Affected: 0.4.8.1-alpha before 0.4.9.10
CVE-2026-77587
7.5
0%
Aug 20
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been…
Affected: 0.4.8.1-alpha before 0.4.9.11
CVE-2026-44602
7.5
0%
May 7
Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006
Affected: before 0.4.9.7
CVE-2026-44601
7.5
0%
May 7
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009
Affected: before 0.4.9.7
CVE-2022-33903
7.5
1%
Jul 17
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation
Affected: 0.4.7.1 before 0.4.7.8
CVE-2021-38385
7.5
2%
Aug 30
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion…
Affected: before 0.3.5.16; 0.4.0.0 before 0.4.5.10; 0.4.6.0 before 0.4.6.7
CVE-2021-34550
7.5
2%
Jun 29
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006
Affected: before 0.3.5.15; 0.4.0.0 before 0.4.4.9; 0.4.5.0 before 0.4.5.9; 0.4.6.0 before 0.4.6.5
CVE-2021-34549
7.5
2%
Jun 29
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005
Affected: before 0.3.5.15; 0.4.0.0 before 0.4.4.9; 0.4.5.0 before 0.4.5.9; 0.4.6.0 before 0.4.6.5
CVE-2021-34548
7.5
3%
Jun 29
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003
Affected: before 0.3.5.15; 0.4.0.0 before 0.4.4.9; 0.4.5.0 before 0.4.5.9; 0.4.6.0 before 0.4.6.5
CVE-2021-28089
7.5
2%
Mar 19
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001
Affected: before 0.3.5.14; 0.4.4.4 before 0.4.4.8; 0.4.5.0 before 0.4.5.7; 0.4.4.0; 0.4.4.1; 0.4.4.2; +1 more
CVE-2020-15572
7.5
1%
Jul 15
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services…
Affected: before 0.3.5.11; after 0.4.2.0 before 0.4.2.8; after 0.4.3.0 before 0.4.3.6; 0.4.4.0; 0.4.4.1
CVE-2020-10593
7.5
2%
Mar 23
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004
Affected: 0.3.5 before 0.3.5.10; after 0.4.1.0 before 0.4.1.9; after 0.4.2.0 through 0.4.2.7
CVE-2020-10592
7.5
3%
Mar 23
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002
Affected: 0.3.5 before 0.3.5.10; after 0.4.1.0 before 0.4.1.9; after 0.4.2.0 through 0.4.2.7
CVE-2015-2929
7.5
1%
Jan 24
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service…
Affected: before 0.2.4.27; 0.2.5.1 before 0.2.5.12; 0.2.6.1 before 0.2.6.7
CVE-2015-2928
7.5
1%
Jan 24
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service…
Affected: before 0.2.4.27; 0.2.5.1 before 0.2.5.12; 0.2.6.1 before 0.2.6.7
CVE-2015-2689
7.5
2%
Jan 24
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause…
Affected: before 0.2.4.26; 0.2.5.1 before 0.2.5.11
CVE-2015-2688
7.5
2%
Jan 24
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to…
Affected: before 0.2.4.26; 0.2.5.1 before 0.2.5.11
CVE-2019-8955
7.5
5%
Feb 21
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via…
Affected: before 0.3.3.12; 0.3.4.8 before 0.3.4.11; 0.3.4.0; 0.3.4.1; 0.3.4.2; 0.3.4.3; +13 more
CVE-2018-0491
7.5
15%
Mar 5
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10
Affected: 0.3.2.0 before 0.3.2.10
CVE-2018-0490
7.5
3%
Mar 5
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10
Affected: through 0.2.9.14; 0.3.1.7 through 0.3.1.9; 0.3.1.1; 0.3.1.2; 0.3.1.3; 0.3.1.4; +11 more
CVE-2016-1254
7.5
3%
Dec 5
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor
Affected: before 0.2.8.12
CVE-2017-0377
7.5
2%
Jul 2
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended…
Affected: 0.3.0.1; 0.3.0.2; 0.3.0.3; 0.3.0.4; 0.3.0.5; 0.3.0.6; +2 more
CVE-2017-0376
7.5
2%
Jun 9
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR…
Affected: before 0.3.0.8
CVE-2017-0375
7.5
3%
Jun 9
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed…
Affected: before 0.3.0.8
CVE-2016-8860
7.5
2%
Jan 4
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c…
Affected: through 0.2.8.8; 0.2.9.0; 0.2.9.1; 0.2.9.2; 0.2.9.3
Showing 27