{"resultsPerPage":4,"startIndex":0,"totalResults":4,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-06T06:34:59.888","vulnerabilities":[{"cve":{"id":"CVE-2018-9105","sourceIdentifier":"cve@mitre.org","published":"2018-03-27T23:29:00.223","lastModified":"2026-06-17T02:06:04.757","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool."},{"lang":"es","value":"NordVPN 3.3.10 para macOS contiene una vulnerabilidad de escalado de privilegios root. La vulnerabilidad proviene del servicio XPC implementado en su herramienta de asistencia con privilegios. Este servicio XPC es responsable de recibir y procesar nuevas peticiones de conexión OpenVPN desde la aplicación principal. Desafortunadamente, este servicio XPC no está protegido, lo que permite que aplicaciones arbitrarias se conecten y envíen mensajes XPC. Un atacante puede enviar mensajes XPC manipulados a la herramienta de asistencia con privilegios solicitando realizar una nueva conexión OpenVPN. Debido a que el atacante controla el contenido del mensaje XPC, puede especificar la localización del ejecutable openvpn que podría apuntar a algún elemento malicioso controlado por él y localizado en alguna parte del disco. Si no se valida el ejecutable openvpn, el atacante tendrá la oportunidad de ejecutar código en el contexto de la herramienta de asistencia con privilegios."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nordvpn:nordvpn:3.3.10:*:*:*:*:macos:*:*","matchCriteriaId":"6AE5CC2E-24B3-408A-8E04-733E7D5CFB71"}]}]}],"references":[{"url":"https://github.com/VerSprite/research/blob/master/advisories/VS-2018-015.md","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/140939","source":"nvd@nist.gov","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/VerSprite/research/blob/master/advisories/VS-2018-015.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-10170","sourceIdentifier":"cve@mitre.org","published":"2018-04-16T21:29:00.513","lastModified":"2026-06-17T01:33:36.833","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the \"nordvpn-service\" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The \"Connect\" method accepts a class instance argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user."},{"lang":"es","value":"NordVPN 6.12.7.0 para Windows sufre de una vulnerabilidad de escalado de privilegios SYSTEM a través del servicio \"nordvpn-service\". Este servicio establece un endpoint NetNamedPipe que permite que aplicaciones instaladas de forma arbitraria se conecten y llamen a métodos expuestos de forma pública. El método \"Connect\" acepta un argumento de instancia de clase que proporciona control al atacante de la línea de comandos de OpenVPN. Un atacante puede especificar un plugin de biblioteca dinámica que debería ejecutarse para cada nuevo intento de conexión de VPN. Este plugin ejecutará código en el contexto del usuario SYSTEM."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nordvpn:nordvpn:6.12.7.0:*:*:*:*:windows:*:*","matchCriteriaId":"54D7033E-6911-4C8E-887A-F6594F6B04FB"}]}]}],"references":[{"url":"https://github.com/VerSprite/research/blob/master/advisories/VS-2018-018.md","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/VerSprite/research/blob/master/advisories/VS-2018-018.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3952","sourceIdentifier":"talos-cna@cisco.com","published":"2018-09-07T15:29:01.017","lastModified":"2026-06-17T01:58:06.203","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges."},{"lang":"es","value":"Existe una vulnerabilidad explotable de ejecución de código en la funcionalidad connect de NordVPN 6.14.28.0. Un archivo de configuración especialmente manipulado podría provocar un escalado de privilegios, lo que resulta en la ejecución de comandos arbitrarios con privilegios del sistema."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Talos","product":"NordVPN","versions":[{"version":"NordVPN 6.14.28.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nordvpn:nordvpn:6.14.28.0:*:*:*:*:*:*:*","matchCriteriaId":"225DDD0E-FC36-4B09-9A3D-8841BE9BF477"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/105312","source":"talos-cna@cisco.com","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0622","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/105312","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0622","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-25572","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-03-21T13:16:21.200","lastModified":"2026-06-17T02:32:42.770","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash."},{"lang":"es","value":"NordVPN 6.19.6 contiene una vulnerabilidad de denegación de servicio que permite a atacantes locales provocar un fallo en la aplicación al enviar una cadena excesivamente larga en el campo de entrada de correo electrónico. Los atacantes pueden pegar un búfer de 100.000 caracteres en el campo de correo electrónico durante el inicio de sesión para provocar un fallo en la aplicación."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Nordvpn","product":"NordVPN","versions":[{"version":"6.19.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-23T15:37:57.295161Z","id":"CVE-2019-25572","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1260"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nordvpn:nordvpn:*:*:*:*:*:windows:*:*","versionEndIncluding":"6.19.6","matchCriteriaId":"C912F120-836D-4BC2-B181-D241D636412A"}]}]}],"references":[{"url":"https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe","source":"disclosure@vulncheck.com","tags":["Broken Link"]},{"url":"https://nordvpn.com/","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://www.exploit-db.com/exploits/46343","source":"disclosure@vulncheck.com","tags":["Exploit","VDB Entry"]},{"url":"https://www.vulncheck.com/advisories/nordvpn-denial-of-service-via-email-field-buffer-overflow","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}}]}