CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product strongswan:strongswan. Show all products

12 CVEs, showing 1 to 12
CVESeverityTitlePublished
CVE-2026-78135Medium 5.6libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine.
Assigned by mitre
Sep 11, 2026
CVE-2026-78134High 7.1strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
Assigned by mitre
Sep 11, 2026
CVE-2026-78133High 7.5libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
Assigned by mitre
Sep 11, 2026
CVE-2026-78132High 7.5strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
Assigned by mitre
Sep 11, 2026
CVE-2026-78131Low 3.7strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
Assigned by mitre
Sep 11, 2026
CVE-2026-78130High 7.5strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
Assigned by mitre
Sep 11, 2026
CVE-2026-78129Medium 5.9strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
Assigned by mitre
Sep 11, 2026
CVE-2026-78127Low 3.7libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
Assigned by mitre
Sep 11, 2026
CVE-2026-78126Medium 5.9strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
Assigned by mitre
Sep 11, 2026
CVE-2026-78124Low 3.7strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
Assigned by mitre
Sep 11, 2026
CVE-2026-78123Medium 5.9strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.
Assigned by mitre
Sep 11, 2026
CVE-2026-47895High 7.5In strongSwan before 6.0.7, identity parsing/cloning is mishandled.
Assigned by mitre
Aug 22, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.