CVE-2026-78129

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS5 decryption...

CVE-2026-78123

strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS7 parsing in the openssl plugin...

CVE-2026-78124

strongSwan 5.0.2 through 6.0.7 allows PKCS7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime...

UBUNTU-CVE-2026-78129

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS5 decryption...

UBUNTU-CVE-2026-78123

strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS7 parsing in the openssl plugin...

UBUNTU-CVE-2026-78124

strongSwan 5.0.2 through 6.0.7 allows PKCS7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime...

PT-2026-89672

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.0.2 through 6.0.7 Description An expired pointer dereference occurs during PKCS7 parsing within the openssl plugin. PKCS7 is a standard for cryptographic messages that allows for the signing and encryption of data...

Debian dsa-6487 : charon-cmd - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6487 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6487-1 [email protected] https://www.debian.org/securit...

PT-2026-89673

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.0.2 through 6.0.7 Description The openssl plugin allows PKCS7 certificate enumeration, which results in a memory leak where memory is not released after its effective lifetime. Recommendations At the moment, there is no...

strongSwan -- multiple vulnerabilities

The strongSwan project reports: strongSwan 6.1.0 fixes eleven vulnerabilities: CVE-2026-78123: A flaw in the openssl plugin in the processing of PKCS7 containers can result in a crash. Affects 5.0.2 and newer. CVE-2026-78124: A flaw in the openssl plugin in the enumeration of certificates in PKCS...

CVE-2026-80439 Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

CVE-2026-80439

The Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10 ) allows unauthenticated users to execute arbitrary shortcodes registered on the site. The root cause is that shortcodes contained in submitted form values are not sanitized before being substituted into an action'...

EUVD-2026-72091

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

CVE-2026-80439 Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

WordPress Redirection for Contact Form 7 plugin 2.2.7-3.2.10 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Redirection for Contact Form 7 versions 2.2.7-3.2.10...

CVE-2026-80439: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

PT-2026-86507

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

CVE-2026-67281 Unauthenticated file read in Mikrotik RouterOS

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

CVE-2026-67281: Access of Uninitialized Pointer

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...