352 matches found
Apache-Pluto-3.0.0--CVE-2018-1306
CVE-2018-1306 Problema en la lógica de autorización de Apache Pluto 3.0.0 que permite a un atacante cargar archivos maliciosos manipulando métodos HTTP. Script escrito en python3. Uso: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...
MCPwnfluence
MCPwnfluence — CVE-2026-27825 y CVE-2026-27826 Dos vulnerabilidades críticas en mcp-atlassian, uno de los servidores MCP más populares del ecosistema más de 4.4K estrellas en GitHub, más de 4M de descargas. Descubiertas por el equipo de Pluto Security. Las Vulnerabilidades...
AZL-98441 CVE-2026-14957 affecting package libreswan 4.15-2
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
CVE-2026-14957
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
EUVD-2026-69820
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
CVE-2026-14957
In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, boring-registry-fips, docker-compose-fips, jitsucom-bulker, ratify-fips, neuvector-sigstore-interface-fips, istio-fips, zitadel, kyverno, grafana-fips, beats-fips, k9s-fips, bank-vaults, mattermost-fips, beats, tkn-fips, pluto-fips, grafana...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: cert-manager-fips, flux-operator-fips, dkron, pluto, steampipe, victorialogs-fips, localstack, flux-source-watcher, podinfo, victoriametrics, amazon-k8s-cni-fips, flux-notification-controller, temporal-fips, victorialogs, cluster-autoscaler-fips, metacontroller,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: metacontroller, flux-helm-controller, pluto, grafana-operator, grafana-rollout-operator, dkron, flux-source-controller, flux-image-automation-controller, stakater-reloader, polaris, go, victoriametrics, terragrunt, flux-notification-controller, victoriametrics-cluste...
GO-2026-4599 vulnerabilities
Vulnerabilities for packages: metacontroller, flux-helm-controller, pluto, grafana-operator, grafana-rollout-operator, dkron, flux-source-controller, flux-image-automation-controller, stakater-reloader, polaris, go, victoriametrics, terragrunt, flux-notification-controller, victoriametrics-cluste...
GO-2025-3602 vulnerabilities
Vulnerabilities for packages: flux-helm-controller, pluto, eksctl, kots, cert-manager-cmctl, helm-operator, cluster-api-helm-controller, zot, chart-testing, tw, cilium-cli, flux-source-controller, k8ssandra-client, flux, helm-docs, helm-push, rancher-helm, chartmuseum, k9s, trivy, zarf, kubescape...
GO-2025-3601 vulnerabilities
Vulnerabilities for packages: flux-helm-controller, pluto, eksctl, kots, cert-manager-cmctl, helm-operator, cluster-api-helm-controller, zot, chart-testing, tw, cilium-cli, flux-source-controller, k8ssandra-client, flux, helm-docs, helm-push, rancher-helm, chartmuseum, k9s, trivy, zarf, kubescape...
GO-2025-3888 vulnerabilities
Vulnerabilities for packages: flux-helm-controller, pluto, eksctl, kots, cert-manager-cmctl, helm-set-status, linkerd2, helm-operator, cluster-api-helm-controller, zot, chart-testing, cilium-cli, k8sgpt, cerbos, flux-source-controller, istio, helm-mapkubeapis, trivy-operator, envoy-gateway, kargo...
GO-2025-3802 vulnerabilities
Vulnerabilities for packages: flux-helm-controller, pluto, eksctl, kots, cert-manager-cmctl, linkerd2, helm-operator, cluster-api-helm-controller, zot, chart-testing, tw, cilium-cli, k8sgpt, cerbos, flux-source-controller, istio, envoy-gateway, kargo, k8ssandra-client, helm-docs, helm-push,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: eksctl, zot, grafana-rollout-operator, containerd, kubernetes-dashboard, bom, k8sgateway, kubernetes-dashboard-api, delve, dive, harbor-cli, controller-gen, cerbos, prometheus-operator, spire-controller-manager, nginx-prometheus-exporter,...
SUSE CVE-2026-12413
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...
OESA-2026-3073 libreswan security update
Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...
Libreswan 4.6 < 5.3.1 DoS
The version of Libreswan installed on the remote host is between 4.6 and 5.3.1 exclusive. It is, therefore, affected by a denial of service vulnerability. An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. The function reassemblev2incomingfragments would...
EUVD-2026-41439
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...