Vulnerabilities

TI-2026-50046 CVE-2026-71417 · GHSA-pxmc-2ffp-8j67

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

HIGH 65

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 7.3 Local Low privileges No interaction EPSS 0.00105 Published 2026-08-18 Fixed in 1.9.3 CWE-639

TI-2026-49980 CVE-2026-71322 · GHSA-4h97-p9wq-chqj

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

LOW 20

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00234 Published 2026-08-18 Fixed in 1.9.3 CWE-862

TI-2026-49975 CVE-2026-71317 · GHSA-g7p5-89mh-248h

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

MEDIUM 62

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00105 Published 2026-08-18 Fixed in 1.9.3 CWE-862

TI-2026-49361 CVE-2026-70666 · GHSA-xpmj-wjcp-6pww

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

LOW 32

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00216 Published 2026-08-18 Fixed in 1.9.3 CWE-918

TI-2026-49964 CVE-2026-71303 · GHSA-v5rc-cpwc-cfpr

Server-side request forgery in Netflix lemur

HIGH 67

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00277 Published 2026-08-18 Fixed in 1.9.3 CWE-918

TI-2026-49965 CVE-2026-71307 · GHSA-6c8m-q6g9-vrw3

Missing authorization in Netflix lemur

HIGH 67

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00314 Published 2026-08-18 Fixed in 1.9.3 CWE-862

TI-2026-49966 CVE-2026-71308 · GHSA-cfh6-pv5c-38jv

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

HIGH 68

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00317 Published 2026-08-18 Fixed in 1.9.3 CWE-639

TI-2026-49362 CVE-2026-70667 · GHSA-f3qq-49m6-rw8f

Time-of-check time-of-use race condition in Netflix lemur

MEDIUM 61

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00179 Published 2026-08-18 Fixed in 1.9.3 CWE-367

TI-2026-39852 CVE-2026-55164 · GHSA-q437-g7fv-2jvv

Lemur: Plaintext password storage in Lemur user-update path

MEDIUM 56

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00289 Published 2026-08-18 Fixed in 1.9.2 CWE-256

TI-2026-39850 CVE-2026-55162 · GHSA-54vg-pfh7-jq95

Server-side request forgery in Netflix lemur

MEDIUM 61

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00216 Published 2026-08-18 Fixed in 1.9.2 CWE-918

TI-2026-39854 CVE-2026-55166 · GHSA-v2wp-frmc-5q3v

Improper authorization in Netflix lemur

HIGH 76

Lemur manages TLS certificate creation.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00287 Published 2026-08-18 Fixed in 1.9.2 CWE-285

TI-2026-39851 CVE-2026-55163 · GHSA-x3vf-mgxj-7785

Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership

LOW 27

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00216 Published 2026-08-18 Fixed in 1.9.2 CWE-863

TI-2026-39853 CVE-2026-55165 · GHSA-r9gp-7f88-9r54

Improper signature verification in Netflix lemur

MEDIUM 55

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00154 Published 2026-08-18 Fixed in 1.9.2 CWE-347

TI-2026-35868 CVE-2026-48508 · GHSA-qcqw-jwxc-2hqg

Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

MEDIUM 40

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00329 Published 2026-08-18 Fixed in 1.9.1 CWE-863

TI-2026-32273 CVE-2026-44305 · GHSA-vr7c-r5gj-j3w5

Lemur: LDAP TLS certificate verification globally disabled enables credential interception

HIGH 65

Lemur manages TLS certificate creation.

CVSS 3.1MEDIUM 6.8 Adjacent network No auth No interaction EPSS 0.00143 Published 2026-05-12 Fixed in 1.9.0 CWE-295

TI-2026-32272 CVE-2026-44304 · GHSA-3r34-vq8m-39gh

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

HIGH 70

Lemur manages TLS certificate creation.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00217 Published 2026-05-12 Fixed in 1.9.0 CWE-90

TI-2024-08634 CVE-2024-9301

A path traversal issue in E2Nest prior to commit 8a41948

MEDIUM 45

A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00692 Published 2024-09-27 Fixed CWE-22

TI-2024-06568 CVE-2024-7093

Server-Side Template Injection in Dispatch Message Templates

MEDIUM 43

Dispatch's notification service uses Jinja templates to generate messages to users.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00508 Published 2024-08-01 Fixed CWE-94

TI-2024-04665 CVE-2024-5023 · GHSA-3783-62vc-jr7x

Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE

MEDIUM 44

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00936 Published 2024-05-16 Fixed in 1.4.0 CWE-77

TI-2024-04374 CVE-2024-4701 · GHSA-wpcv-5jgp-69f3

Path Traversal vulnerability via File Uploads in Genie

HIGH 82

A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.24629 Published 2024-05-10 Fixed in 4.3.18 CWE-22

TI-2023-21044 CVE-2023-40171

Dispatch writes JWT tokens in error message

HIGH 78

Dispatch is an open source security incident management tool.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00935 Published 2023-08-17 Fixed in 20230817 CWE-209

TI-2023-14607 CVE-2023-30797 · GHSA-5fqv-mpj8-h7gm

Insecure Random Generation in Netflix Lemur

MEDIUM 40

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00791 Published 2023-04-19 Fixed in 1.3.2 CWE-330

TI-2022-10301 CVE-2022-27177 · GHSA-74w3-2r77-fw5h

A Python format string issue leading to information disclosure and potentially remote…

MEDIUM 46

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02257 Published 2022-04-01 Fixed in 1.2.2 CWE-134

TI-2021-09343 CVE-2021-28099 · GHSA-9295-mhf3-v33m

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the…

LOW 20

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00251 Published 2021-03-23 No fix listed CWE-330

TI-2021-09344 CVE-2021-28100 · GHSA-f4jh-ww96-9h9j

Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.

LOW 24

Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00268 Published 2021-03-23 No fix listed CWE-377

Vulnerabilities

Filters