Skip to content
Noroxi

torproject records

53 published records for vendor torproject.

Researcher profile

Entered KEV
1 · 1.9%
Weaponized
1 · 1.9%
Pre-auth RCE
0
With a fix record
88.7%
Median publish → KEV
1837 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

53 records
  • CVE-2016-9079
    86Now

    A use-after-free vulnerability in SVG Animation has been discovered.

    HighCVSS 7.5KEVWeaponizedEPSS 87%

    debian · debian linuxJun 11, 2018

  • CVE-2018-16983
    40Plan

    NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html

    CriticalCVSS 9.8No exploitEPSS 3%

    noscript · noscriptSep 13, 2018

  • CVE-2026-77642
    37Monitor

    tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type

    CriticalCVSS 9.3No exploitEPSS 0%

    torproject · torAug 20, 2026

  • CVE-2026-44603
    36Monitor

    Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

    CriticalCVSS 9.1No exploitEPSS 1%

    torproject · torMay 7, 2026

  • CVE-2026-44597
    36Monitor

    Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

    CriticalCVSS 9.1No exploitEPSS 1%

    torproject · torMay 6, 2026

  • CVE-2026-77638
    36Monitor

    Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersona

    CriticalCVSS 9.0No exploitEPSS 0%

    torproject · torAug 20, 2026

  • CVE-2018-0491
    34Monitor

    A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.

    HighCVSS 7.5Proof of conceptEPSS 15%

    torproject · torMar 5, 2018

  • CVE-2026-77641
    32Monitor

    tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails.

    HighCVSS 8.2No exploitEPSS 0%

    torproject · torAug 20, 2026

  • CVE-2026-77584
    32Monitor

    Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams.

    HighCVSS 8.2No exploitEPSS 0%

    torproject · torAug 20, 2026

  • CVE-2019-8955
    31Monitor

    In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against To

    HighCVSS 7.5No exploitEPSS 5%

    torproject · torFeb 21, 2019

  • CVE-2020-10592
    31Monitor

    Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption)

    HighCVSS 7.5No exploitEPSS 3%

    torproject · torMar 23, 2020

  • CVE-2016-1254
    31Monitor

    Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.

    HighCVSS 7.5No exploitEPSS 3%

    torproject · torDec 5, 2017

  • CVE-2021-34548
    31Monitor

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003.

    HighCVSS 7.5No exploitEPSS 3%

    torproject · torJun 29, 2021

  • CVE-2018-0490
    31Monitor

    An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10.

    HighCVSS 7.5No exploitEPSS 3%

    torproject · torMar 5, 2018

  • CVE-2017-0375
    31Monitor

    The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_f

    HighCVSS 7.5No exploitEPSS 3%

    torproject · torJun 9, 2017

  • CVE-2017-0377
    31Monitor

    Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJul 2, 2017

  • CVE-2020-10593
    31Monitor

    Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), ak

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torMar 23, 2020

  • CVE-2015-2689
    31Monitor

    Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load,

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJan 24, 2020

  • CVE-2015-2688
    31Monitor

    buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layo

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJan 24, 2020

  • CVE-2017-0376
    31Monitor

    The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_proce

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJun 9, 2017

  • CVE-2016-8860
    31Monitor

    Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination,

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJan 4, 2017

  • CVE-2021-38385
    31Monitor

    Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verificatio

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torAug 30, 2021

  • CVE-2021-28089
    31Monitor

    Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torMar 19, 2021

  • CVE-2021-34549
    30Monitor

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005.

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJun 29, 2021

  • CVE-2021-34550
    30Monitor

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006.

    HighCVSS 7.5No exploitEPSS 2%

    torproject · torJun 29, 2021