CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 5:30 AM ET)

What this means for you

This week: 3,335 CVEs published, 225 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,335; Show in the list
Critical, last 7 days: 225; Show in the list
Healthcare-tagged, last 7 days: 3; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product strongswan:strongswan. Show all products

14 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2025-62291	High 8.1	In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially re… Assigned by mitre	Jan 15, 2026
CVE-2026-25075	High 7.5	strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow Assigned by VulnCheck	Mar 23, 2026
CVE-2026-47895	High 7.5	In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Assigned by mitre	Aug 21, 2026
CVE-2026-78123	Medium 5.9	strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. Assigned by mitre	Sep 10, 2026
CVE-2026-78124	Low 3.7	strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. Assigned by mitre	Sep 10, 2026
CVE-2026-78126	Medium 5.9	strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. Assigned by mitre	Sep 10, 2026
CVE-2026-78127	Low 3.7	libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. Assigned by mitre	Sep 10, 2026
CVE-2026-78129	Medium 5.9	strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. Assigned by mitre	Sep 10, 2026
CVE-2026-78130	High 7.5	strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. Assigned by mitre	Sep 10, 2026
CVE-2026-78131	Low 3.7	strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. Assigned by mitre	Sep 10, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.