Known Vulnerabilities for Pluto by Apache
Listed below are 6 of the newest known vulnerabilities associated with "Pluto" by "Apache".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-94453 json | Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection... | Not Provided | 2026-10-13 | 2026-10-16 |
| CVE-2026-77206 json | Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result o... | Not Provided | 2026-10-13 | 2026-10-16 |
| CVE-2026-19624 json | A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.se... | Not Provided | 2026-09-14 | 2026-09-14 |
| CVE-2026-14957 json | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. ... | Not Provided | 2026-09-02 | 2026-09-02 |
| CVE-2021-36739 json | The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross... | 6.1 - MEDIUM | 2022-01-06 | 2022-01-12 |
| CVE-2021-36738 json | The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting ... | 6.1 - MEDIUM | 2022-01-06 | 2022-01-12 |
| CVE-2021-36737 json | The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrat... | 6.1 - MEDIUM | 2022-01-06 | 2022-01-12 |
| CVE-2020-15250 json | Not Provided | 2020-10-12 | 2026-10-07 | |
| CVE-2019-0186 json | The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) at... | 6.1 - MEDIUM | 2019-04-26 | 2023-11-07 |
| CVE-2018-1306 json | The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attack... | 7.5 - HIGH | 2018-06-27 | 2019-03-01 |