GHSA-6C8M-Q6G9-VRW3 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...

CVE-2026-71307

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

EUVD-2026-61153

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

SFTP plugin to Ghost Commander - SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application SFTP plugin to Ghost Commander published at the 'play' market has multiple vulnerabilities...