OpenSSL vulnerabilities: known CVEs & security history
OpenSSL · Infrastructure · 34 tracked CVEs · 0 actively exploited · updated September 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all OpenSSL release lines — 34 in total. A CVE here doesn't mean your version is affected — check OpenSSL's current status and the safe version to run.
Known OpenSSL CVEs
Actively-exploited and most-severe first. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2026-63073 | critical | 9.8 | 1% | 2026 |
| CVE-2026-31789 | critical | 9.8 | 0% | 2026 |
| CVE-2026-75803 | critical | 9.1 | 0% | 2026 |
| CVE-2026-34182 | critical | 9.1 | 0% | 2026 |
| CVE-2026-45447 | high | 8.8 | 4% | 2026 |
| CVE-2025-15467 | high | 8.8 | 48% | 2026 |
| CVE-2026-7383 | high | 8.1 | 0% | 2026 |
| CVE-2026-28387 | high | 8.1 | 1% | 2026 |
| CVE-2026-63076 | high | 7.5 | 1% | 2026 |
| CVE-2026-63075 | high | 7.5 | 0% | 2026 |
| CVE-2026-63072 | high | 7.5 | 1% | 2026 |
| CVE-2026-54874 | high | 7.5 | 1% | 2026 |
| CVE-2026-14457 | high | 7.5 | 1% | 2026 |
| CVE-2026-9076 | high | 7.5 | 0% | 2026 |
| CVE-2026-45445 | high | 7.5 | 0% | 2026 |
| CVE-2026-42765 | high | 7.5 | 0% | 2026 |
| CVE-2026-42764 | high | 7.5 | 1% | 2026 |
| CVE-2026-34183 | high | 7.5 | 1% | 2026 |
| CVE-2026-34180 | high | 7.5 | 1% | 2026 |
| CVE-2026-31790 | high | 7.5 | 1% | 2026 |
| CVE-2026-28390 | high | 7.5 | 1% | 2026 |
| CVE-2026-28389 | high | 7.5 | 1% | 2026 |
| CVE-2026-28388 | high | 7.5 | 1% | 2026 |
| CVE-2026-28386 | high | 7.5 | 0% | 2026 |
| CVE-2026-34181 | high | 7.4 | 0% | 2026 |
| CVE-2026-42771 | medium | 6.2 | 0% | 2026 |
| CVE-2026-63074 | medium | 5.9 | 0% | 2026 |
| CVE-2026-42767 | medium | 5.9 | 0% | 2026 |
| CVE-2026-42766 | medium | 5.9 | 1% | 2026 |
| CVE-2026-42769 | medium | 5.3 | 0% | 2026 |
| CVE-2026-35188 | medium | 5 | 0% | 2026 |
| CVE-2026-45446 | medium | 4.8 | 0% | 2026 |
| CVE-2026-42770 | low | 3.7 | 0% | 2026 |
| CVE-2026-42768 | low | 3.7 | 0% | 2026 |
Is my OpenSSL version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your OpenSSL version → · Monitor OpenSSL for new CVEs →
OpenSSL vulnerabilities — frequently asked
How many known vulnerabilities does OpenSSL have?
IsItPatched tracks 34 CVEs for OpenSSL. 4 are critical-severity and 21 high-severity. These span every release line — what matters is whether the version you run is affected.
Does OpenSSL have any actively-exploited vulnerabilities?
None of OpenSSL's tracked CVEs are currently in CISA's KEV catalog — but new ones can be added at any time, so keep your version current.
What is the most severe OpenSSL vulnerability?
Among tracked issues, CVE-2026-63073 (CRITICAL, CVSS 9.8) ranks highest — a CWE-134 weakness.
Is OpenSSL safe to use?
It depends on the version. The latest supported OpenSSL release (4.0.2) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: OpenSSL security status · OpenSSL end-of-life · actively-exploited CVEs. Always verify against OpenSSL's advisories — see our disclaimer.