CVE-2026-71417 | High | 7.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another ce… |
CVE-2026-71322 | Medium | 4.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branc… |
CVE-2026-71317 | Medium | 6.5 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority whe… |
CVE-2026-71308 | High | 8.1 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers t… |
CVE-2026-71307 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write… |
CVE-2026-71303 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1… |
CVE-2026-70666 | High | 7.4 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and… |
CVE-2026-70667 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the l… |
CVE-2026-55166 | Critical | 9.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destina… |
CVE-2026-55165 | Medium | 4.8 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] fr… |
CVE-2026-55164 | Medium | 4.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/user… |
CVE-2026-55163 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), wh… |
CVE-2026-55162 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded cert… |
CVE-2026-48508 | High | 8.8 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.P… |
CVE-2026-44305 | Medium | 6.8 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disa… |
CVE-2026-44304 | High | 8.1 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitize… |
CVE-2024-9301 | High | 7.5 | 2024-09-27 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a |
CVE-2024-7093 | | | 2024-08-01 | Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly san… |
CVE-2024-5023 | | | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affe… |
CVE-2024-4701 | Critical | 9.9 | 2024-05-14 | A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 |
CVE-2023-40171 | Critical | 9.1 | 2023-08-17 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when… |
CVE-2023-30797 | High | 7.5 | 2023-04-19 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacke… |
CVE-2022-27177 | Critical | 9.8 | 2022-04-01 | A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2 |
CVE-2021-28100 | Medium | 5.5 | 2021-03-23 | Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything wri… |
CVE-2021-28099 | Medium | 4.4 | 2021-03-23 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permission… |
CVE-2020-2323 | Medium | 5.3 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access t… |
CVE-2020-2322 | High | 7.5 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to ge… |
CVE-2020-9300 | Medium | 6.5 | 2020-11-09 | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participan… |
CVE-2020-9299 | Medium | 5.4 | 2020-11-09 | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Ty… |
CVE-2020-9297 | Critical | 9.8 | 2020-07-14 | Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint v… |
CVE-2020-9296 | Critical | 9.8 | 2020-06-16 | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of in… |
CVE-2019-10028 | High | 7.5 | 2019-06-21 | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. |
CVE-2015-7764 | High | 7.5 | 2017-08-09 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. |
CVE-2017-7266 | Medium | 6.1 | 2017-03-26 | Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespecti… |