CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,435
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product netflix:lemur. Show all products

14 CVEs, showing 1 to 14
CVESeverityTitlePublished
CVE-2026-48508High 8.8Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55165Medium 4.8Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55163Medium 6.3Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55166Critical 9.9Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55162Medium 6.3Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-55164Medium 4.9Lemur: Plaintext password storage in Lemur user-update path
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-70667Medium 6.3Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71308High 8.1Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71307High 7.7Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71303High 7.7Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-70666High 7.4Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71317Medium 6.5Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71322Medium 4.3Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-71417High 7.3Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Assigned by GitHub_M
Aug 18, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.