CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

EUVD-2026-77774

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Apache Pluto 3.0.0 の認可ロジックにおける問題で、攻撃者が HTTP メソッドを改ざんして悪意のあるファイルをアップロードできるようになります。 python3 で書かれたスクリプト。 使用方法: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

MCPwnfluence

MCPwnfluence — CVE-2026-27825 与 CVE-2026-27826 mcp-atlassian 中的两个严重漏洞，该服务器是生态系统中广受欢迎的 MCP 服务器之一（GitHub 星标 4.4K+，下载量 400 万+）。 由 Pluto Security 团队发现。 漏洞详情 CVE| CVSS| 类型| 描述 ---|---|---|--- CVE-2026-27825| 9.1 严重| 任意文件写入 / RCE| 附件下载中的路径遍历漏洞，允许向主机文件系统写入任意文件 CVE-2026-27826| 8.2 高危| 通过 Header 注入实现 SSRF...

AZL-98441 CVE-2026-14957 affecting package libreswan 4.15-2

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

EUVD-2026-69820

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: beats, docker-compose-fips, neuvector-sigstore-interface-fips, bank-vaults, beats-fips, jitsucom-bulker, grafana-fips, rancher-security-scan, k9s-fips, pluto-fips, boring-registry-fips, istio-fips, tkn-fips, kyverno-notation-aws-fips, grafana, mattermost-fips, kyvern...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, podinfo, flux-helm-controller, go, victorialogs, flux-image-automation-controller, flux-source-controller, flux-operator, gotenberg, amazon-k8s-cni-fips, nova, flux-operator-fips, dkron, cluster-autoscaler-fips, aws-ebs-csi-driver-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: terragrunt, pluto, grafana-rollout-operator, flux-image-reflector-controller, polaris, stakater-reloader, flux-image-automation-controller, metacontroller, steampipe, flux-source-controller, go, dkron, flux-notification-controller, nova, flux-helm-controller,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: terragrunt, pluto, grafana-rollout-operator, flux-image-reflector-controller, polaris, stakater-reloader, flux-image-automation-controller, metacontroller, steampipe, flux-source-controller, go, dkron, flux-notification-controller, nova, flux-helm-controller,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: pluto, k9s, zarf, trivy, tw, zot, cilium-cli, kubescape, flux-source-controller, helm-operator, kots, flux-helm-controller, cert-manager-cmctl, chart-testing, flux, k8ssandra-client, eksctl, helm-push, chartmuseum, rancher-helm, helm-docs, cluster-api-helm-controller...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: pluto, k9s, zarf, trivy, tw, zot, cilium-cli, kubescape, flux-source-controller, helm-operator, kots, flux-helm-controller, cert-manager-cmctl, chart-testing, flux, k8ssandra-client, eksctl, helm-push, chartmuseum, rancher-helm, helm-docs, cluster-api-helm-controller...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: cerbos, pluto, istio, k9s, zarf, trivy, helm-set-status, zot, kargo, trivy-operator, rancher-fleet, cilium-cli, kubescape, headlamp, k8sgpt, flux-source-controller, helm-operator, kots, helm-mapkubeapis, nova, flux-helm-controller, cert-manager-cmctl, chart-testing,...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cerbos, pluto, istio, k9s, zarf, trivy, tw, zot, kargo, rancher-fleet, cilium-cli, k8sgpt, flux-source-controller, helm-operator, kots, flux-helm-controller, cert-manager-cmctl, chart-testing, linkerd2, k8ssandra-client, eksctl, envoy-gateway, helm-push, chartmuseum,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: wire-go, cerbos, nri-haproxy, rclone, kubernetes-csi-external-health-monitor, kapp, portieris, kapp-controller, undock, zot, falcoctl, polaris, hubble, kubernetes-dashboard-api, nginx-prometheus-exporter, wal-g, k8sgateway, lazydocker, nuclei, helm-operator, nodetain...

SUSE CVE-2026-12413

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...

OESA-2026-3073 libreswan security update

Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...