CVE-2026-33432

CVE-2026-33432 affects Roxy-WI up to version 8.2.8.2. When LDAP authentication is enabled, the code concatenates the login username directly into the LDAP search filter without escaping special characters, enabling an unauthenticated attacker to inject LDAP metacharacters, manipulate the query, a...

CVE-2026-33432 Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without...

📄 openDCIM 25.01 SQL Injection / Remote Code Execution

openDCIM version 25.01 remote SQL injection exploit that achieves remote code execution. ================================================================================================================================== | Title : openDCIM 25.01 SQL Injection Leading to Remote Code Execution | |...

CVE-2026-33432: Improper Authentication

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without...

PT-2026-33846

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without...

Linux Distros Unpatched Vulnerability : CVE-2026-0636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all prov...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the LdapProfileService class, which accepts ID-based search parameters in multiple methods. A privileged attacker can execute unauthorized LDAP queries and perform arbitrary directory operations. Remediation Upgrade...

com.axelor:axelor-core (>=8.0.0, <=8.1.1), com.axelor:axelor-web (>=8.0.0, <=8.1.1) potentially affected by CVE-2026-40458 +1 more via org.pac4j:pac4j-ldap (>=6.2.2, <=6.3.1)

org.pac4j:pac4j-ldap MAVEN version =6.2.2, =8.0.0, =8.0.0, =8.1.1 Source cves: CVE-2026-40458, CVE-2026-40459 Source advisory: SNYK:JAVA-ORGPAC4J-16109662...

ch.exense.commons:exense-auth-ldap (>=1.3.0, <=1.3.1), ch.exense.commons:exense-core-server (>=1.3.0, <=1.3.1) +12 more potentially affected by CVE-2026-40458 +1 more via org.pac4j:pac4j-ldap (>=4.0.0, <=4.4.0)

org.pac4j:pac4j-ldap MAVEN version =4.0.0, =1.3.0, =1.3.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =1.0.0.release, =1.0.1.release Source cves: CVE-2026-40458, CVE-2026-40459 Source advisory: SNYK:JAVA-ORGPAC4J-16109662...

org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...

org.pac4j:pac4j-cas (1.8.0-rc1), org.pac4j:pac4j-gae (1.8.0-rc1) +10 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.0-rc1)

org.pac4j:pac4j-core MAVEN version 1.8.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.8.0-rc1 - org.pac4j:pac4j-gae 1.8.0-rc1 - org.pac4j:pac4j-http 1.8.0-rc1 - org.pac4j:pac4j-jw...

org.pac4j:pac4j-cas (4.5.3), org.pac4j:pac4j-config (4.5.3) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.3)

org.pac4j:pac4j-core MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.3 - org.pac4j:pac4j-config 4.5.3 - org.pac4j:pac4j-couch 4.5.3 - org.pac4j:pac4j-gae 4.5.3 -...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

com.axelor:axelor-core (>=8.0.0, <=8.1.1), com.axelor:axelor-web (>=8.0.0, <=8.1.1) potentially affected by CVE-2026-40458 +1 more via org.pac4j:pac4j-ldap (>=6.2.2, <=6.3.1)

org.pac4j:pac4j-ldap MAVEN version =6.2.2, =8.0.0, =8.0.0, =8.1.1 Source cves: CVE-2026-40458, CVE-2026-40459 Source advisory: MEND:CVE-2026-40459...

cc.akkaha:asura-play_2.12 (>=0.5.0, <=0.6.0), cc.akkaha:pea_2.12 (>=0.1.0, <=0.7.0) +14 more potentially affected by CVE-2026-40458 +1 more via org.pac4j:pac4j-ldap (>=3.0.1, <=4.4.0)

org.pac4j:pac4j-ldap MAVEN version =3.0.1, =0.5.0, =0.1.0, =1.3.0, =1.3.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.1 and more Source cves: CVE-2026-40458, CVE-2026-40459 Source advisory: MEND:CVE-2026-40459...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

CVE-2026-40459: Improper Neutralization of Special Elements used in an LDAP Query

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

PT-2026-33452

Name of the Vulnerable Software and Affected Versions pac4j versions prior to 4.5.10 pac4j versions prior to 5.7.10 pac4j versions prior to 6.4.1 Description LDAP Injection is possible in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search...

CVE-2026-40683

A flaw was found in OpenStack Keystone. When using the LDAP identity backend, the system incorrectly processes the user enabled attribute if the userenabledinvert configuration option is set to False. This error causes users marked as disabled in LDAP to be treated as enabled within Keystone,...