TO
Product
Tor
On CISA KEVExploited in the wild
48
CVEs
1
On KEV
9.3
Max CVSS
0
New 30D
Severity mix
Critical 4High 27Medium 10Low 0
Watch
Add Tor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-23589 | 6.5 | Jan 14 | The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002 Affected: before 0.4.7.13 |
| CVE-2017-16541 | 6.5 | Nov 4 | Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web… Affected: before 7.0.9 |
| CVE-2017-0380 | 5.9 | Sep 18 | The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x… Affected: through 0.2.8.14; 0.2.9.0; 0.2.9.0; 0.2.9.1; 0.2.9.2; 0.2.9.3; +25 more |
| CVE-2021-46702 | 5.5 | Feb 26 | Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure Affected: 9.0.7 |
| CVE-2026-77640 | 5.3 | Aug 20 | tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1 Affected: 0.2.6.1-alpha before 0.4.9.9 |
| CVE-2026-77639 | 5.3 | Aug 20 | Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to… Affected: 0.3.1.1-alpha before 0.4.9.9 |
| CVE-2026-44600 | 5.3 | May 7 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010 Affected: before 0.4.9.7 |
| CVE-2026-44599 | 5.3 | May 7 | Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008 Affected: before 0.4.9.7 |
| CVE-2021-28090 | 5.3 | Mar 19 | Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002 Affected: before 0.3.5.14; 0.4.4.4 before 0.4.4.8; 0.4.5.0 before 0.4.5.7; 0.4.4.0; 0.4.4.1; 0.4.4.2; +1 more |
| CVE-2020-8516 | 5.3 | Feb 2 | The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for… Affected: through 0.4.1.8; 0.4.2.0 through 0.4.2.6 |
Showing 10