https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-111223.htmlhttps://patchthecve.com/cve/CVE-2026-111223.htmlMon, 19 Oct 2026 20:43:24 +0000HIGH 7.2: Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.confhttps://patchthecve.com/cve/CVE-2026-78135.htmlhttps://patchthecve.com/cve/CVE-2026-78135.htmlWed, 16 Sep 2026 19:37:30 +0000MEDIUM 5.6: libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.https://patchthecve.com/cve/CVE-2026-78134.htmlhttps://patchthecve.com/cve/CVE-2026-78134.htmlMon, 14 Sep 2026 20:06:44 +0000HIGH 7.1: strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.https://patchthecve.com/cve/CVE-2026-78133.htmlhttps://patchthecve.com/cve/CVE-2026-78133.htmlMon, 14 Sep 2026 20:07:44 +0000HIGH 7.5: libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.https://patchthecve.com/cve/CVE-2026-78132.htmlhttps://patchthecve.com/cve/CVE-2026-78132.htmlMon, 14 Sep 2026 20:08:12 +0000HIGH 7.5: strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.https://patchthecve.com/cve/CVE-2026-78131.htmlhttps://patchthecve.com/cve/CVE-2026-78131.htmlMon, 14 Sep 2026 20:08:24 +0000LOW 3.7: strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.https://patchthecve.com/cve/CVE-2026-78130.htmlhttps://patchthecve.com/cve/CVE-2026-78130.htmlTue, 15 Sep 2026 16:17:24 +0000HIGH 7.5: strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.https://patchthecve.com/cve/CVE-2026-78129.htmlhttps://patchthecve.com/cve/CVE-2026-78129.htmlMon, 14 Sep 2026 20:08:56 +0000MEDIUM 5.9: strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.https://patchthecve.com/cve/CVE-2026-78127.htmlhttps://patchthecve.com/cve/CVE-2026-78127.htmlMon, 14 Sep 2026 20:09:10 +0000LOW 3.7: libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.https://patchthecve.com/cve/CVE-2026-78126.htmlhttps://patchthecve.com/cve/CVE-2026-78126.htmlMon, 14 Sep 2026 20:09:26 +0000MEDIUM 5.9: strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.https://patchthecve.com/cve/CVE-2026-78124.htmlhttps://patchthecve.com/cve/CVE-2026-78124.htmlMon, 14 Sep 2026 20:09:47 +0000LOW 3.7: strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.https://patchthecve.com/cve/CVE-2026-78123.htmlhttps://patchthecve.com/cve/CVE-2026-78123.htmlTue, 15 Sep 2026 16:17:24 +0000MEDIUM 5.9: strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.