High
CVE-2026-71417
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 18
Reset filters
Medium
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
High
CVE-2026-71307
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Medium
CVE-2026-70667
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
High
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
High
CVE-2026-71303
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
Medium
CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Medium
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
High
CVE-2026-48508
Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-55164
Lemur user-update path stores plaintext passwords
Medium
CVE-2026-44305
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
High
CVE-2026-44304
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Critical
CVE-2026-55166
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
High
CVE-2023-30797
Lemur subject to insecure random generation
High
CVE-2015-7764
Lemur uses static IV per key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.