FrançaisShown in its original language — a full translation is planned for a future version.
Multiples vulnérabilités dans les produits StormShield
view advisory published 2026-10-21
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (19)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-113810US | — | — | ||
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
Through the captive portal an attacker can inject an XSS when requesting certificate creation fo… | ||||
| CVE-2026-113808US | — | — | ||
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
Through the captive portal an attacker can inject an XSS when requesting user creation. The stor… | ||||
| CVE-2026-78135US | high7.3 | — | ||
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authenticati… | ||||
| CVE-2026-78131US | — | — | ||
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. | ||||
| CVE-2026-78130US | — | — | ||
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. | ||||
| CVE-2026-78129US | — | — | ||
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. | ||||
| CVE-2026-78124US | — | — | ||
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. | ||||
| CVE-2026-78123US | — | — | ||
strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. | ||||
| CVE-2026-84732US | — | — | ||
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout i… | ||||
| CVE-2026-18408US | — | — | ||
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating syst… | ||||
| CVE-2026-15741US | — | — | ||
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse con… | ||||
| CVE-2026-14666US | — | — | ||
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after t… | ||||
| CVE-2026-58045US | — | — | ||
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synch… | ||||
| CVE-2026-58040US | — | — | ||
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vul… | ||||
| CVE-2026-56850US | medium4.4 | — | ||
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with… | ||||
| CVE-2026-48931US | low3.7 | — | ||
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported relea… | ||||
| CVE-2026-45447US | — | Exploit | ||
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could
trigger a use-after-free during PKCS#7 signature verification.
Impact summary: A use-after-free may result… | ||||
| CVE-2026-42768US | — | — | ||
Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to
Bleichenbacher-style attack when an attacker is able to provide the CMS or
S/MIME messages and observe… | ||||
| CVE-2026-34181US | — | — | ||
Issue Summary: The PKCS#12 file processing fails to perform sufficient input
validation for files that use Password-Based Message Authentication Code 1
(PBMAC1) integrity mechanism… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan