Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
832 results · page 3 of 17
Jun 9, 2026The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.CVE-2026-9751 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.8
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password.CVE-2026-41720 · Other software · Spring · reported by security@vmware.comHigh 7.4
Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.
- Product
- Spring LDAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.6CVE-2026-29167 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jun 2, 2026An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.CVE-2026-10611 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.2
An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge. As a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code. The issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checksCVE-2026-10549 · Other software · Yandex · reported by browser-security@yandex-team.ruMedium 5.3
LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.
- Product
- Yandex Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname.CVE-2026-35563 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. This oversight leaves the connection highly vulnerable to server impersonation and complete connection compromise. The root cause of this vulnerability lies in the incomplete TLS server identity verification within the LDAP client implementation. The attacker requires MITM capability on the network to exploit this vulnerability. This attacker must be able to present a certificate trusted by the client's configured trust store. The hostname verification has been enforced in the new version of the LDAP API
- Product
- Apache Directory LDAP API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 29, 2026A flaw was found in the Quay config-tool's LDAP and SMTP validation functions.CVE-2026-10052 · Other software · Red Hat · reported by Red HatMedium 4.1
A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make outbound connections to user-supplied endpoints without proper IP or host filtering. This allows the attacker to perform internal network reconnaissance from the Quay pod's network position, potentially mapping the internal network infrastructure.
- Product
- Red Hat Quay 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
May 27, 2026Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.CVE-2026-48919 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.6
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
- Product
- Jenkins Active Directory Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.CVE-2026-48918 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.6
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
- Product
- Jenkins Active Directory Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.CVE-2026-48917 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.6
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.
- Product
- Jenkins LDAP Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.CVE-2026-48916 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.6
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.
- Product
- Jenkins LDAP Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection.CVE-2026-48844 · Email & office · reported by MITREHigh 7.5
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bCVE-2026-46745 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.
- Product
- Apache Airflow FAB provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 22, 2026An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates froCVE-2026-44930 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 21, 2026An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited informationCVE-2026-44063 · Other software · Netatalk · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cMedium 4.2
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
- Product
- Netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDCVE-2026-44052 · Other software · Netatalk · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cHigh 7.5
Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.
- Product
- Netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.CVE-2026-41919 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 13, 2026When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd CVE-2026-39455 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.CVE-2026-34339 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiCVE-2026-3048 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.1
An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Apr 22, 2026Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.CVE-2026-33609 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.
- Product
- Authoritative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026PAC4J is vulnerable to LDAP Injection in multiple methods.CVE-2026-40459 · Other software · PAC4J · reported by cvd@cert.plHigh 8.7
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1
- Product
- PAC4J
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.CVE-2026-0636 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630Medium 5.5
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
- Product
- BC-JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuratiCVE-2026-40683 · Other software · OpenStack · reported by MITREHigh 7.7
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.
- Product
- Keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Mar 27, 2026If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.CVE-2026-27860 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comLow 3.7
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
- Product
- OX Dovecot Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Mar 20, 2026Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation.CVE-2026-33369 · Email & office · Synacor · reported by MITREMedium 4.3
Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application fails to properly sanitize user-supplied input before incorporating it into an LDAP search filter. An authenticated attacker can exploit this issue by sending a crafted SOAP request that manipulates the LDAP query, allowing retrieval of sensitive directory attributes.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Mar 17, 2026LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2026-27895 · Other software · LDAPAccountManager · reported by GitHubMedium 4.3
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2026-27894 · Other software · LDAPAccountManager · reported by GitHubHigh 8.8
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this vulnerability. Version 9.5 fixes the issue. Although upgrading is recommended, a workaround would be to make /var/lib/ldap-account-manager/config read-only for the web-server user and delete the PDF profile files (making PDF exports impossible).
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.CVE-2026-21243 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.CVE-2026-25560 · Other software · WeKan · reported by VulnCheckHigh 8.7
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.
- Product
- WeKan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 throuCVE-2026-25815 · Network & remote access · Fortinet · reported by MITRELow 3.2
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.fortinet.comcert.at
Feb 5, 2026YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI.CVE-2026-1966 · Other software · YugabyteDB Inc · reported by security@yugabyte.comLow 2.4
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
- Product
- YugabyteDB Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts throCVE-2020-36966 · Other software · Dolibarr · reported by VulnCheckMedium 5.1
Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts through multiple parameters. Attackers can exploit the host, slave, and port parameters in /dolibarr/admin/ldap.php to execute arbitrary JavaScript and potentially steal user cookie information.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddolibarr.orgexploit-db.com
Jan 30, 2026An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP auCVE-2026-1498 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7
An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Jan 20, 2026A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870.CVE-2025-36556 · Other software · MedDream · reported by talos-cna@cisco.comMedium 6.1
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 16, 2026In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) viCVE-2025-31510 · Other software · lemonldap-ng · reported by MITREHigh 7.2
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.
- Product
- LemonLDAP::NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orglists.debian.org
Jan 13, 2026Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.CVE-2026-20812 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 CVE-2025-14524 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 5.3
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and thereforCVE-2025-14017 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 6.3
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() functCVE-2026-22185 · Other software · OpenLDAP Foundation · reported by VulnCheckMedium 4.6
OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.
- Product
- OpenLDAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.openldap.orgseclists.org
Dec 19, 2025LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation.CVE-2023-53958 · Other software · ltb-project · reported by VulnCheckHigh 8.6
LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
- Product
- LDAP Tool Box Self Service Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 10, 2025Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method.CVE-2025-13953 · Other software · GTT · reported by cve-coordination@incibe.esCritical 9.3
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method. Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data received, allowing an attacker with access to the local machine or internal network to impersonate the legitimate WebSocket and inject manipulated information. Exploiting this vulnerability could allow an attacker to authenticate as any user in the domain, without the need for valid credentials, compromising the confidentiality, integrity, and availability of the application and its data.
- Product
- Sistema de Información Tributario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025A vulnerability was determined in opsre go-ldap-admin up to 20251011.CVE-2025-13948 · Other software · opsre · reported by VulDBLow 2.9
A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. Executing manipulation of the argument secret key can lead to use of hard-coded cryptographic key . The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- go-ldap-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Nov 25, 2025A flaw was found in the Keycloak LDAP User Federation provider.CVE-2025-13467 · Other software · Keycloak · reported by Red HatMedium 5.5
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 21, 2025Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecuCVE-2025-13357 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.4
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.CVE-2025-12765 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 7.5
pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the CVE-2025-12764 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 7.5
pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal opCVE-2025-34280 · Other software · Nagios · reported by VulnCheckHigh 8.6
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field duriCVE-2025-34270 · Other software · Nagios · reported by VulnCheckMedium 6.9
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.nagios.comnagios.com
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticateCVE-2024-13999 · Other software · Nagios · reported by VulnCheckHigh 7.3
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.