Proton AG operates a portfolio focused on privacy-oriented communication and network products, with its primary exposure traced to ProtonVPN and related offerings alongside legacy components. The observed vulnerability patterns center on OS command injection and search-path handling issues characteristic of systems-level code and command-line interfaces. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Proton AG over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-50917HIGH ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers | Jan 13, 2026 | 7.8 | 28 | NO | NO |
CVE-2024-37391HIGH ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss. | Jul 22, 2024 | 7.8 | 23 | NO | NO |
CVE-2022-25224MEDIUM Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an | May 20, 2022 | 5.4 | 20 | NO | NO |
CVE-2006-3293MEDIUM parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages. | Jun 29, 2006 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Proton AG.
Media articles that mention a CVE ID that affects a product developed by Proton AG — matched by CVE ID, not by vendor name.