Login Request a demo
LE
Product
lemonldap-ng
by lemonldap-ng · last CVE Jun 21, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 6High 3Medium 4Low 0
Severity
All severities14Critical6High3Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add lemonldap-ng to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-19791
9.8
1%
May 29
In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG…
Affected: before 2.0.7
CVE-2023-28862
9.8
1%
Mar 31
An issue was discovered in LemonLDAP::NG before 2.16.1
Affected: before 2.16.1
CVE-2021-40874
9.8
1%
Jul 18
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13
Affected: 2.0.13
CVE-2020-24660
9.8
2%
Sep 14
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used
Affected: through 2.0.8
CVE-2019-15941
9.8
2%
Sep 25
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request
Affected: 2.0.0 through 2.0.5
CVE-2019-12046
9.8
3%
May 22
LemonLDAP::NG -2.0.3 has Incorrect Access Control
Affected: 2.0.3
CVE-2021-35472
8.8
2%
Jul 30
An issue was discovered in LemonLDAP::NG before 2.0.12
Affected: through 2.0.11
CVE-2020-16093
7.5
1%
Jul 18
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default…
Affected: through 2.0.8
CVE-2025-31510
7.2
0%
Jan 16
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab…
Affected: 2.0.8 before 2.16.5; 2.17.0 before 2.21.0
CVE-2024-48933
6.1
0%
Oct 9
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if…
Affected: before 2.19.3
CVE-2022-37186
5.9
1%
Apr 16
In LemonLDAP::NG before 2.0.15
Affected: before 2.0.15
CVE-2026-12804
4.3
0%
Jun 21
lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect
Affected: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +18 more
CVE-2023-44469
4.3
1%
Sep 29
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs…
Affected: before 2.17.1
CVE-2012-6426
–
2%
Jan 1
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions…
Affected: through 1.2.2; 0.8.1; 0.8.2; 0.8.3; 0.9.1; 0.9.2; +13 more
Showing 14