EUVD-2026-75920

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...

CVE-2026-78134

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...

CVE-2026-78134

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

CVE-2026-78126 affects strongSwan (an IKE/IPsec suite), versions 4.1.10 through 6.0.7 . The vulnerability is a NULL-pointer dereference in the eap-aka plugin triggered when processing an unexpected AKA-Synchronization-Failure message, which can result in a crash (denial of service). The CVSS 3.1 ...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

EUVD-2026-75900

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

PT-2026-89740

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...

PT-2026-89674

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-35330

CVE-2026-35330 Desbordamiento de búfer en el montón previo a la autenticación en el analizador de atributos EAP-SIM / EAP-AKA de strongSwan mediante subdesbordamiento de enteros. Descripción parseattributes en src/libsimaka/simakamessage.c:419 lee cabeceras TLV cuyo byte length cuenta palabras de...

CVE-2022-0853

CVE-2022-0853 CVE-2022-0853 在 jboss 客户端侧，当重复使用 UserTransaction 时存在内存泄漏。 例如： private void testTransaction throws Exception root@kitploit: forint i=1; i 500000; i++ System.out.println"Starting process " + i; // get the UserTransaction and EJB Proxy Context ctx = getInitialContexthost, port, usernam...

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-78134

Missing Inner EAP Method Authentication Details...

UBUNTU-CVE-2026-78134

Missing Inner EAP Method Authentication Details...

CVE-2026-86404 Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-86404

Red Hat EAP 's Artemis messaging component permits deserialization by default due to a misconfiguration in its security filtering. Specifically, ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which applies allow-list/block-list filtering via checkSecurity()/isTrustedType(). Howe...

EUVD-2026-72352

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

PT-2026-86687

🚨HIGH - Red Hat EAP Artemis ObjectMessage Unsafe Deserialization Default CVE-2026-86404 In Red Hat EAP’s Artemis messaging, the deserialization trust check allows any class when both allow-list and block-list are empty, so untrusted ObjectMessage payloads deserialize by default. Remote attackers...