PureVPN operates a consumer VPN application whose disclosed vulnerabilities cluster around credential management and access-control weaknesses, including insufficiently protected credentials, incorrect permission assignment, and exposure of sensitive information to unauthorized actors. Treat this as a compact vendor profile; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Purevpn over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-6822CRITICAL In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as root. | Feb 7, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-10204HIGH PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the OpenVPN protocol, the "sevpnclient" serv | Apr 18, 2018 | 8.8 | 26 | NO | NO |
CVE-2018-7484HIGH An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition | Feb 26, 2018 | 7.8 | 26 | NO | NO |
CVE-2018-18656HIGH The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PROGRAMDATA%\purevpn\config\login.conf. Ad | Oct 26, 2018 | 7.8 | 24 | NO | NO |
CVE-2023-48957MEDIUM PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default DNS servers. | Aug 25, 2024 | 5.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Purevpn.
Media articles that mention a CVE ID that affects a product developed by Purevpn — matched by CVE ID, not by vendor name.