OpenSSL vulnerabilities: known CVEs & security history
OpenSSL · Infrastructure · 83 tracked CVEs · 0 actively exploited · updated October 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all OpenSSL release lines — 83 in total. A CVE here doesn't mean your version is affected — check OpenSSL's current status and the safe version to run.
Known OpenSSL CVEs
Actively-exploited and most-severe first. Showing the top 80 of 83. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2026-63073 | critical | 9.8 | 1% | 2026 |
| CVE-2026-31789 | critical | 9.8 | 0% | 2026 |
| CVE-2022-2274 | critical | 9.8 | 46% | 2022 |
| CVE-2021-3711 | critical | 9.8 | 88% | 2021 |
| CVE-2026-75803 | critical | 9.1 | 0% | 2026 |
| CVE-2026-34182 | critical | 9.1 | 0% | 2026 |
| CVE-2026-45447 | high | 8.8 | 4% | 2026 |
| CVE-2025-15467 | high | 8.8 | 52% | 2026 |
| CVE-2026-84782 | high | 8.2 | 0% | 2026 |
| CVE-2026-7383 | high | 8.1 | 0% | 2026 |
| CVE-2026-28387 | high | 8.1 | 1% | 2026 |
| CVE-2023-4807 | high | 7.8 | 1% | 2023 |
| CVE-2026-84784 | high | 7.5 | 0% | 2026 |
| CVE-2026-84783 | high | 7.5 | 0% | 2026 |
| CVE-2026-72897 | high | 7.5 | 0% | 2026 |
| CVE-2026-54873 | high | 7.5 | 0% | 2026 |
| CVE-2026-63076 | high | 7.5 | 1% | 2026 |
| CVE-2026-63075 | high | 7.5 | 0% | 2026 |
| CVE-2026-63072 | high | 7.5 | 1% | 2026 |
| CVE-2026-54874 | high | 7.5 | 1% | 2026 |
| CVE-2026-18798 | high | 7.5 | 1% | 2026 |
| CVE-2026-14457 | high | 7.5 | 1% | 2026 |
| CVE-2026-9076 | high | 7.5 | 0% | 2026 |
| CVE-2026-45445 | high | 7.5 | 0% | 2026 |
| CVE-2026-42765 | high | 7.5 | 0% | 2026 |
| CVE-2026-42764 | high | 7.5 | 1% | 2026 |
| CVE-2026-34183 | high | 7.5 | 1% | 2026 |
| CVE-2026-34180 | high | 7.5 | 1% | 2026 |
| CVE-2026-31790 | high | 7.5 | 1% | 2026 |
| CVE-2026-28390 | high | 7.5 | 1% | 2026 |
| CVE-2026-28389 | high | 7.5 | 1% | 2026 |
| CVE-2026-28388 | high | 7.5 | 1% | 2026 |
| CVE-2026-28386 | high | 7.5 | 0% | 2026 |
| CVE-2023-0464 | high | 7.5 | 4% | 2023 |
| CVE-2023-0215 | high | 7.5 | 4% | 2023 |
| CVE-2022-4450 | high | 7.5 | 20% | 2023 |
| CVE-2022-1473 | high | 7.5 | 3% | 2022 |
| CVE-2022-0778 | high | 7.5 | 73% | 2022 |
| CVE-2020-1967 | high | 7.5 | 53% | 2020 |
| CVE-2018-0732 | high | 7.5 | 49% | 2018 |
| CVE-2026-34181 | high | 7.4 | 0% | 2026 |
| CVE-2023-0286 | high | 7.4 | 62% | 2023 |
| CVE-2021-3450 | high | 7.4 | 18% | 2021 |
| CVE-2022-2068 | high | 7.3 | 95% | 2022 |
| CVE-2022-1292 | high | 7.3 | 83% | 2022 |
| CVE-2023-6129 | medium | 6.5 | 2% | 2024 |
| CVE-2023-2650 | medium | 6.5 | 75% | 2023 |
| CVE-2026-42771 | medium | 6.2 | 0% | 2026 |
| CVE-2026-63074 | medium | 5.9 | 0% | 2026 |
| CVE-2026-42767 | medium | 5.9 | 0% | 2026 |
| CVE-2026-42766 | medium | 5.9 | 1% | 2026 |
| CVE-2022-4304 | medium | 5.9 | 16% | 2023 |
| CVE-2022-1434 | medium | 5.9 | 1% | 2022 |
| CVE-2021-3449 | medium | 5.9 | 64% | 2021 |
| CVE-2018-0734 | medium | 5.9 | 12% | 2018 |
| CVE-2018-0735 | medium | 5.9 | 5% | 2018 |
| CVE-2018-0737 | medium | 5.9 | 12% | 2018 |
| CVE-2024-0727 | medium | 5.5 | 3% | 2024 |
| CVE-2026-75806 | medium | 5.3 | 0% | 2026 |
| CVE-2026-75805 | medium | 5.3 | 0% | 2026 |
| CVE-2026-75804 | medium | 5.3 | 0% | 2026 |
| CVE-2026-42772 | medium | 5.3 | 0% | 2026 |
| CVE-2026-35189 | medium | 5.3 | 0% | 2026 |
| CVE-2026-42769 | medium | 5.3 | 0% | 2026 |
| CVE-2023-5678 | medium | 5.3 | 4% | 2023 |
| CVE-2023-3817 | medium | 5.3 | 3% | 2023 |
| CVE-2023-3446 | medium | 5.3 | 7% | 2023 |
| CVE-2023-0466 | medium | 5.3 | 2% | 2023 |
| CVE-2023-0465 | medium | 5.3 | 2% | 2023 |
| CVE-2022-2097 | medium | 5.3 | 5% | 2022 |
| CVE-2022-1343 | medium | 5.3 | 1% | 2022 |
| CVE-2019-1551 | medium | 5.3 | 14% | 2019 |
| CVE-2026-35188 | medium | 5 | 0% | 2026 |
| CVE-2026-45446 | medium | 4.8 | 0% | 2026 |
| CVE-2018-5407 | medium | 4.7 | 3% | 2018 |
| CVE-2015-0204 | medium | 4.3 | 99% | 2015 |
| CVE-2026-77696 | low | 3.7 | 0% | 2026 |
| CVE-2026-54875 | low | 3.7 | 0% | 2026 |
| CVE-2026-54872 | low | 3.7 | 0% | 2026 |
| CVE-2026-35191 | low | 3.7 | 0% | 2026 |
3 older / lower-severity CVEs not shown — see OpenSSL's full record.
Is my OpenSSL version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your OpenSSL version → · Monitor OpenSSL for new CVEs →
OpenSSL vulnerabilities — frequently asked
How many known vulnerabilities does OpenSSL have?
IsItPatched tracks 83 CVEs for OpenSSL. 6 are critical-severity and 39 high-severity. These span every release line — what matters is whether the version you run is affected.
Does OpenSSL have any actively-exploited vulnerabilities?
None of OpenSSL's tracked CVEs are currently in CISA's KEV catalog — but new ones can be added at any time, so keep your version current.
What is the most severe OpenSSL vulnerability?
Among tracked issues, CVE-2026-63073 (CRITICAL, CVSS 9.8) ranks highest — a CWE-134 weakness.
Is OpenSSL safe to use?
It depends on the version. The latest supported OpenSSL release (4.0.3) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: OpenSSL security status · OpenSSL end-of-life · actively-exploited CVEs. Always verify against OpenSSL's advisories — see our disclaimer.