Alta
CVE-2026-71417
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 18
Restablecer filtros
Media
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
Alta
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Alta
CVE-2026-71307
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Media
CVE-2026-70667
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Alta
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Alta
CVE-2026-71303
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
Media
CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Media
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
Media
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Alta
CVE-2026-48508
Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Media
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Media
CVE-2026-55164
Lemur user-update path stores plaintext passwords
Media
CVE-2026-44305
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
Alta
CVE-2026-44304
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Crítica
CVE-2026-55166
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
Alta
CVE-2023-30797
Lemur subject to insecure random generation
Alta
CVE-2015-7764
Lemur uses static IV per key
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.