CVE-2026-32096

CVE-2026-32096 SSRF via unvalidated AWS SNS SubscriptionConfirmation inuseplunk/plunk Summary The Plunk API endpoint POST /webhooks/sns fetches an attacker-supplied SubscribeURL without verifying the AWS SNS cryptographic signature. An unauthenticated attacker can force the server to make arbitra...

CVE-2026-113808

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-111088

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-111088

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS VPN log monitoring screen . This flaw (CWE-79) allows for the improper neutralization of input during web page generation. The vulnerability has a CVSS 3.1 score of 6.5 (Medium) , with a high impact on confidentiality. No specifi...

CVE-2026-111088 Stored XSS in the VPN logs monitor

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

EUVD-2026-105258

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-113810 Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal . An attacker can inject malicious scripts via the captive portal while requesting certificate creation for a user. The payload remains stored and can only be triggered when an administrator performs validation....

EUVD-2026-105257

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

EUVD-2026-105253

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113808

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal . An attacker can inject malicious scripts through the captive portal during a user creation request. The vulnerability is triggered specifically when an administrator performs validation of the request. No spec...

CVE-2026-113808 Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113469

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

EUVD-2026-104841

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

CVE-2026-113469

The SNS is vulnerable to a logic error in its signature verification routine . This flaw allows the system to accept unauthenticated dynamic data updates during the Autoupdate routine . The vulnerability (CWE-287) can lead to high impacts on confidentiality , integrity , and availability (CVSS 3....

CVE-2026-113469 Improper Signature Verification of Active Update Files

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...

CVE-2026-113465 Possible DOM XSS in SNS Web Administration Portal

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into...

CVE-2026-113465

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Stormshield’s web administration panel . An attacker can execute malicious scripts by crafting a URL containing a payload within a specific parameter and tricking an authenticated administrator into visiting it. The impact involves hi...

PT-2026-118268

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine...