Proton Project develops encrypted communication and privacy-focused applications, with a modestly represented vulnerability footprint centered on its core Proton product line. The observed disclosures cluster around web-page generation and cross-site scripting weaknesses, typical of client-facing application interfaces. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Proton Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-50917HIGH ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers | Jan 13, 2026 | 7.8 | 28 | NO | NO |
CVE-2024-37391HIGH ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss. | Jul 22, 2024 | 7.8 | 23 | NO | NO |
CVE-2022-25224MEDIUM Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an | May 20, 2022 | 5.4 | 20 | NO | NO |
CVE-2006-3293MEDIUM parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages. | Jun 29, 2006 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Proton Project.
Media articles that mention a CVE ID that affects a product developed by Proton Project — matched by CVE ID, not by vendor name.