ST
Vendor
Stormshield
74
CVEs
0
On KEV
6
New 30D
Products
SN9.8
Stormshield Network Security
Stormshield
44 CVEs0 on KEV6 new
ES9.8
Endpoint Security
Stormshield
15 CVEs0 on KEV0 new
SM7.5
Stormshield Management Center
Stormshield
8 CVEs0 on KEV0 new
NS7.5
Network Security
Stormshield
3 CVEs0 on KEV0 new
SV7.8
Ssl Vpn Client
Stormshield
3 CVEs0 on KEV0 new
SS5.9
Sslvpn
Stormshield
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111088 | SN Stormshield Network Security Stormshield | 6.5 | Oct 20 | Stored XSS in the VPN logs monitor |
| CVE-2026-113810 | SN Stormshield Network Security Stormshield | 7.0 | Oct 20 | Stored XSS on SNS Enrollment Portal |
| CVE-2026-113808 | SN Stormshield Network Security Stormshield | 7.1 | Oct 20 | Stored XSS on SNS Enrollment Portal |
| CVE-2026-113469 | SN Stormshield Network Security Stormshield | 7.5 | Oct 20 | Improper Signature Verification of Active Update Files |
| CVE-2026-113465 | SN Stormshield Network Security Stormshield | 6.6 | Oct 20 | Possible DOM XSS in SNS Web Administration Portal |
| CVE-2026-111090 | SN Stormshield Network Security Stormshield | 7.8 | Oct 20 | Improper Signature Verification of Firmware Update Files |
| CVE-2026-14466 | SN Stormshield Network Security Stormshield | 4.3 | Sep 4 | Possible XSS in the SNS web administration panel |
| CVE-2026-8482 | SN Stormshield Network Security Stormshield | 4.3 | Jul 2 | Information leak in NSRPC client history |
| CVE-2026-8480 | SN Stormshield Network Security Stormshield | 4.3 | Jul 1 | Connection possible to the Administration portal with a revoked certificate |
| CVE-2026-8474 | SN StormShield Network Security StormShield | 5.3 | Jun 1 | Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances. |
| CVE-2025-48707 | SN Stormshield Network Security Stormshield | 7.5 | Sep 25 | An issue was discovered in Stormshield Network Security (SNS) before 5.0.1 |
| CVE-2023-41165 | SN Stormshield Network Security Stormshield | 4.8 | Feb 29 | An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and… |
| CVE-2023-34198 | SN Stormshield Network Security Stormshield | 7.3 | Feb 29 | In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before… |
| CVE-2023-28616 | SN Stormshield Network Security Stormshield | 7.5 | Dec 26 | An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1 |
| CVE-2023-47091 | SN Stormshield Network Security Stormshield | 7.5 | Dec 25 | An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before… |
| CVE-2023-47093 | SN Stormshield Network Security Stormshield | 6.5 | Dec 21 | An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0 |
| CVE-2023-41166 | SN Stormshield Network Security Stormshield | 5.3 | Dec 21 | An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1 |
| CVE-2023-26095 | SN Stormshield Network Security Stormshield | 7.5 | Aug 28 | ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet |
| CVE-2022-46783 | SV Ssl Vpn Client Stormshield | 5.3 | Aug 28 | An issue was discovered in Stormshield SSL VPN Client before 3.2.0 |
| CVE-2021-27932 | SV Ssl Vpn Client Stormshield | 7.8 | Aug 25 | Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions |
| CVE-2020-11711 | SN Stormshield Network Security Stormshield | 4.8 | Aug 25 | An issue was discovered in Stormshield SNS 3.8.0 |
| CVE-2022-46782 | SV Ssl Vpn Client Stormshield | 7.8 | Aug 5 | An issue was discovered in Stormshield SSL VPN Client before 3.2.0 |
| CVE-2023-35800 | ES Endpoint Security Stormshield | 4.3 | Jun 27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions |
| CVE-2023-35799 | ES Endpoint Security Stormshield | 5.5 | Jun 27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions |
| CVE-2023-23562 | ES Endpoint Security Stormshield | 4.3 | May 31 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters |
| CVE-2023-23561 | ES Endpoint Security Stormshield | 5.5 | May 30 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information |
| CVE-2023-20052 | SN Stormshield Network Security Stormshield | 5.3 | Mar 1 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier,… |
| CVE-2023-20032 | SN Stormshield Network Security Stormshield | 9.8 | Mar 1 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and… |
| CVE-2023-0401 | SM Stormshield Management Center Stormshield | 7.5 | Feb 8 | A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data |
| CVE-2023-0216 | SM Stormshield Management Center Stormshield | 7.5 | Feb 8 | An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions |
| CVE-2022-4304 | ES Endpoint Security Stormshield | 5.9 | Feb 8 | Timing Oracle in RSA Decryption |
| CVE-2022-4450 | SN Stormshield Network Security Stormshield | 7.5 | Feb 8 | Double free after calling PEM_read_bio_ex |
| CVE-2023-0215 | SM Stormshield Management Center Stormshield | 7.5 | Feb 8 | Use-after-free following BIO_new_NDEF |
| CVE-2023-0286 | SM Stormshield Management Center Stormshield | 7.4 | Feb 8 | X.400 address type confusion in X.509 GeneralName |
| CVE-2022-40617 | SN Stormshield Network Security Stormshield | 7.5 | Oct 31 | strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that… |
| CVE-2022-27812 | SN Stormshield Network Security Stormshield | 7.5 | Aug 24 | Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can lead to SNS DoS |
| CVE-2022-37434 | SN Stormshield Network Security Stormshield | 9.8 | Aug 5 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field |
| CVE-2022-32215 | SM Stormshield Management Center Stormshield | 6.5 | Jul 14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers |
| CVE-2022-32214 | SM Stormshield Management Center Stormshield | 6.5 | Jul 14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests |
| CVE-2022-32213 | SM Stormshield Management Center Stormshield | 6.5 | Jul 14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request… |
| CVE-2022-30279 | SN Stormshield Network Security Stormshield | 7.5 | May 12 | An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8 |
| CVE-2022-23989 | SN Stormshield Network Security Stormshield | 7.5 | Mar 15 | In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to the SSLVPN service… |
| CVE-2021-3398 | SN Stormshield Network Security Stormshield | 5.8 | Feb 10 | Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component |
| CVE-2021-37613 | SN Stormshield Network Security Stormshield | 6.5 | Feb 10 | Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service |
| CVE-2021-31814 | SN Stormshield Network Security Stormshield | 6.1 | Feb 10 | In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SSL Client |
| CVE-2021-31617 | SN Stormshield Network Security Stormshield | 9.8 | Jan 31 | In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0.1 through 4.2.2, mishandling of memory… |
| CVE-2021-28962 | SN Stormshield Network Security Stormshield | 7.2 | Jan 31 | Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands |
| CVE-2021-28096 | SN Stormshield Network Security Stormshield | 5.3 | Jan 27 | An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used) |
| CVE-2022-22703 | NS Network Security Stormshield | 5.5 | Jan 17 | In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer |
| CVE-2021-45885 | NS Network Security Stormshield | 7.5 | Dec 29 | An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8) |
| CVE-2021-45091 | ES Endpoint Security Stormshield | 4.3 | Dec 21 | Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control |
| CVE-2021-45090 | ES Endpoint Security Stormshield | 9.8 | Dec 21 | Stormshield Endpoint Security before 2.1.2 allows remote code execution |
| CVE-2021-45089 | ES Endpoint Security Stormshield | 5.2 | Dec 21 | Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control |
| CVE-2002-20001 | SN Stormshield Network Security Stormshield | 7.5 | Nov 11 | The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive… |
| CVE-2021-35957 | ES Endpoint Security Stormshield | 6.7 | Jul 13 | Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs (in… |
| CVE-2021-31224 | ES Endpoint Security Stormshield | 3.5 | Jul 13 | SES Evolution before 2.1.0 allows duplicating an existing security policy by leveraging access of a user having read-only access to security policies |
| CVE-2021-31223 | ES Endpoint Security Stormshield | 5.7 | Jul 13 | SES Evolution before 2.1.0 allows reading some parts of a security policy by leveraging access to a computer having the administration console installed |
| CVE-2021-31222 | ES Endpoint Security Stormshield | 5.7 | Jul 13 | SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed |
| CVE-2021-31221 | ES Endpoint Security Stormshield | 5.7 | Jul 13 | SES Evolution before 2.1.0 allows deleting some parts of a security policy by leveraging access to a computer having the administration console installed |
| CVE-2021-31220 | ES Endpoint Security Stormshield | 5.2 | Jul 13 | SES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies |