Patchfirst: OpenSSL vulnerabilitieshttps://patchfirst.co/vendor/openssl/New and newly exploited OpenSSL CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2025-15467: Stack buffer overflow in CMS (Auth)EnvelopedData parsinghttps://patchfirst.co/cve/CVE-2025-15467/CVE-2025-15467Tue, 27 Jan 2026 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 74.8% (higher than 99.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 32.4 of 100.public-exploitCVE-2024-6119: Possible denial of service in X.509 name checkshttps://patchfirst.co/cve/CVE-2024-6119/CVE-2024-6119Tue, 03 Sep 2024 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 66.6% (higher than 99.28% of CVEs). CVSS 7.5 HIGH. Priority 26.2 of 100.CVE-2023-2650: Possible DoS translating ASN.1 object identifiershttps://patchfirst.co/cve/CVE-2023-2650/CVE-2023-2650Tue, 30 May 2023 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 75.4% (higher than 99.51% of CVEs). CVSS 6.5 MEDIUM. Priority 26.2 of 100.CVE-2023-0286: X.400 address type confusion in X.509 GeneralNamehttps://patchfirst.co/cve/CVE-2023-0286/CVE-2023-0286Wed, 08 Feb 2023 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 69.3% (higher than 99.36% of CVEs). CVSS 7.4 HIGH. Priority 28.1 of 100.CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflowhttps://patchfirst.co/cve/CVE-2022-3786/CVE-2022-3786Tue, 01 Nov 2022 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 92.5% (higher than 99.83% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 33.2 of 100.public-exploitCVE-2022-3602: X.509 Email Address 4-byte Buffer Overflowhttps://patchfirst.co/cve/CVE-2022-3602/CVE-2022-3602Tue, 01 Nov 2022 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 90.8% (higher than 99.8% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 33.2 of 100.public-exploitCVE-2022-2068: The c_rehash script allows command injectionhttps://patchfirst.co/cve/CVE-2022-2068/CVE-2022-2068Tue, 21 Jun 2022 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 96.4% (higher than 99.88% of CVEs). CVSS 9.8 CRITICAL. Priority 29.8 of 100.[KEV] CVE-2014-0160: OpenSSL Information Disclosure Vulnerabilityhttps://patchfirst.co/cve/CVE-2014-0160/CVE-2014-0160#kevWed, 04 May 2022 00:00:00 GMTOpenSSL · OpenSSL. In CISA KEV since 2022-05-04. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 1 threat report. Priority 72.1 of 100.kevpublic-exploitT1190T1005CVE-2022-1292: The c_rehash script allows command injectionhttps://patchfirst.co/cve/CVE-2022-1292/CVE-2022-1292Tue, 03 May 2022 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 34.8 of 100.public-exploitCVE-2022-0778: Infinite loop in BN_mod_sqrt() reachable when parsing certificateshttps://patchfirst.co/cve/CVE-2022-0778/CVE-2022-0778Tue, 15 Mar 2022 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 73.2% (higher than 99.46% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 33.1 of 100.public-exploitCVE-2021-3711: SM2 Decryption Buffer Overflowhttps://patchfirst.co/cve/CVE-2021-3711/CVE-2021-3711Tue, 24 Aug 2021 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 87.8% (higher than 99.76% of CVEs). Priority 21.3 of 100.CVE-2021-3449: NULL pointer deref in signature_algorithms processinghttps://patchfirst.co/cve/CVE-2021-3449/CVE-2021-3449Thu, 25 Mar 2021 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 63.5% (higher than 99.21% of CVEs). Public exploit code exists. Priority 26.4 of 100.public-exploitCVE-2017-3730: Bad (EC)DHE parameters cause a client crashhttps://patchfirst.co/cve/CVE-2017-3730/CVE-2017-3730Thu, 04 May 2017 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 55.3% (higher than 99.03% of CVEs). Public exploit code exists. Priority 24.8 of 100.public-exploitCVE-2017-3731: Truncated packet could crash via OOB readhttps://patchfirst.co/cve/CVE-2017-3731/CVE-2017-3731Thu, 04 May 2017 00:00:00 GMTOpenSSL · OpenSSL. Not in CISA KEV. EPSS 57.3% (higher than 99.08% of CVEs). Priority 19.8 of 100.