ch.exense.commons:exense-auth-ldap (>=1.3.0, <=1.3.1), ch.exense.commons:exense-core-server (>=1.3.0, <=1.3.1) +12 more potentially affected by CVE-2026-40458 +1 more via org.pac4j:pac4j-ldap (>=4.0.0, <=4.4.0)

org.pac4j:pac4j-ldap MAVEN version =4.0.0, =1.3.0, =1.3.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =1.0.0.release, =1.0.1.release Source cves: CVE-2026-40458, CVE-2026-40459 Source advisory: SNYK:JAVA-ORGPAC4J-16109662...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the LdapProfileService class, which accepts ID-based search parameters in multiple methods. A privileged attacker can execute unauthorized LDAP queries and perform arbitrary directory operations. Remediation Upgrade...

org.pac4j:pac4j-cas (1.8.0-rc1), org.pac4j:pac4j-gae (1.8.0-rc1) +10 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.0-rc1)

org.pac4j:pac4j-core MAVEN version 1.8.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.8.0-rc1 - org.pac4j:pac4j-gae 1.8.0-rc1 - org.pac4j:pac4j-http 1.8.0-rc1 - org.pac4j:pac4j-jw...

org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...