•27 minutes ago•CVE-2026-62988
9.0CVE-2026-62988: Multi-Factor Authentication and Credential Bypass in Froxlor API
An insecure data retrieval flaw in the Froxlor server administration panel API allows authenticated remote attackers to retrieve unredacted bcrypt password hashes and Base32-encoded Time-Based One-Time Password (TOTP) seeds. Affected endpoints include several 'get' and 'listing' handlers for customers, administrators, and FTP accounts. Utilizing these leaked parameters, attackers can crack the password hashes offline and concurrently generate valid second-factor authentication codes to completely bypass access controls.
0 views•6 min read
•about 1 hour ago•CVE-2026-70666
7.4CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management
CVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.
1 views•5 min read
•about 2 hours ago•CVE-2026-70667
6.3CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification
A security vulnerability in Netflix Lemur, a TLS certificate management framework, allows authenticated operators to bypass Server-Side Request Forgery (SSRF) mitigations. The issue exists within the certificate revocation verification workflow, specifically inside the CRL and OCSP retrieval logic. By exploiting HTTP redirects or DNS rebinding (Time-of-Check Time-of-Use) mechanisms, an attacker can coerce the server into issuing arbitrary network requests to internal services, such as the cloud instance metadata service (IMDS) or loopback addresses. This bypass neutralizes previous network-boundary validation logic and allows blind read/write SSRF targeting internal infrastructure resources.
2 views•6 min read
•about 3 hours ago•CVE-2026-71303
7.7CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates
Netflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.
3 views•6 min read
•about 4 hours ago•CVE-2026-71307
7.7CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API
An authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.
2 views•6 min read
•about 5 hours ago•CVE-2026-71308
8.1CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur
Netflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.
8 views•7 min read
•about 6 hours ago•CVE-2026-71317
6.5CVE-2026-71317: Missing Authorization in Netflix Lemur Allows Unauthorized Subordinate CA Creation
CVE-2026-71317 is a critical Broken Object-Level Authorization (BOLA) / Missing Authorization vulnerability in Netflix Lemur versions prior to 1.9.3. When the self-service authority creation option is enabled (ADMIN_ONLY_AUTHORITY_CREATION = False), Lemur allows authenticated non-read-only users to request the creation of a subordinate Certificate Authority (sub-CA) chained to any internal parent authority, even if the requesting user lacks administrative or usage permissions over that parent CA. This allows attackers to generate subordinate CAs signed by trusted root certificates, exposing private keys and compromising the organizational PKI trust chain.
4 views•7 min read
•about 7 hours ago•CVE-2026-71322
4.3CVE-2026-71322: Missing Authorization Check in Netflix Lemur Certificate Export
Netflix Lemur, a TLS/SSL certificate management framework, contains a missing authorization check in its certificate export endpoint. Prior to version 1.9.3, the validation logic verifying whether a user had permission to export a certificate was incorrectly placed inside a block that executed only if the selected plugin required a private key. When an authenticated user attempted to export a certificate using a plugin that did not require the private key, the authorization check was bypassed, allowing unauthorized access to the public portions of the certificate and producing misleading audit logs.
4 views•6 min read
•about 8 hours ago•GHSA-JF24-8G2H-2WG7
7.2GHSA-JF24-8G2H-2WG7: Remote Code Execution in LibreNMS AboutController via Binary Path Substitution
A critical security flaw in LibreNMS allows authenticated administrators to execute arbitrary commands by modifying the configured binary path for snmpget and accessing the About page. This occurs due to insufficient verification of the executable file's identity and integrity prior to executing it with shell_exec.
2 views•6 min read
•about 9 hours ago•GHSA-7CJ5-V4PP-V632
4.8GHSA-7cj5-v4pp-v632: Stored Cross-Site Scripting in LibreNMS Graph Descriptions
LibreNMS versions prior to 26.7.0 are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. An authenticated administrator can inject arbitrary HTML or JavaScript into graph descriptions via specific administrative configuration endpoints. When another authenticated user views the affected graph, the unescaped payload executes within their browser context.
3 views•5 min read
•about 10 hours ago•GHSA-7GWW-X7FH-JF9J
8.1GHSA-7GWW-X7FH-JF9J: SSRF-Driven Stored Cross-Site Scripting in LibreNMS Oxidized Integration
An injection vulnerability in LibreNMS's Oxidized integration component allows administrative or network-positioned attackers to achieve stored cross-site scripting (XSS). By setting a malicious oxidized.url endpoint, the server makes outbound queries and processes returned JSON fields containing malicious HTML or JavaScript. These payloads are outputted directly in the web UI without appropriate output encoding.
3 views•6 min read
•about 11 hours ago•CVE-2026-17106
7.1CVE-2026-17106: Container-to-Host Arbitrary File Write in moby/go-archive (CopyEscape)
CVE-2026-17106 (CopyEscape) is a container-to-host arbitrary file-write vulnerability within Docker's archiving and extraction library moby/go-archive. By utilizing a Time-of-Check to Time-of-Use (TOCTOU) race condition during the file-walking stage inside a running container, a malicious container process can force the host engine to produce a compromised tar stream. During client-side extraction, the Docker CLI resolves directory entries through absolute symbolic links, resulting in arbitrary file creation or modification on the host system.
6 views•6 min read