Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-90
Weakness type CWE-90 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 42 | 42 | 0 |
Monthly trend
▂▁▁▂▃▄▅▅█▅
2026-01 1 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 3 · 2026-06 5 · 2026-07 7 · 2026-08 7 · 2026-09 12 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-42568 | 4.3 | 62.5 | — | Yamcs Vulnerable to LDAP Injection in LdapAuthModule |
| CVE-2026-46619 | 9.3 | 61.9 | — | OpenAM Authentication Bypass via MSISDN LDAP Injection |
| CVE-2026-1498 | 7.0 | 60.1 | — | WatchGuard Firebox LDAP Injection |
| CVE-2026-47303 | 8.8 | 57.2 | — | ASP.NET Core Elevation of Privilege Vulnerability |
| CVE-2026-44617 | 6.5 | 57.1 | — | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 |
| CVE-2026-58222 | 8.8 | 56.0 | — | Samba: samba ad ldap compare filter injection and trusted-request confusion disclose pr… |
| CVE-2026-44616 | 6.5 | 54.4 | — | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction |
| CVE-2026-46745 | 5.3 | 54.3 | — | Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap rea… |
| CVE-2026-49268 | 8.8 | 54.3 | — | Apache Shiro: LDAP DN Injection in DefaultLdapRealm |
| CVE-2026-11748 | 6.9 | 48.6 | — | — |
| CVE-2026-75020 | 7.0 | 44.7 | — | Apache APISIX: ldap-auth plugin cross-subtree identity impersonation |
| CVE-2026-11770 | 7.5 | 43.4 | — | 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check |
| CVE-2026-0636 | 5.5 | 43.5 | — | LDAP Injection Vulnerability in LDAPStoreHelper.java |
| CVE-2026-55770 | 6.8 | 43.4 | — | OpenBao: LDAPi ldaputil (wrong escape func) |
| CVE-2026-13696 | 8.8 | 42.8 | — | LDAP Injection in HAVELSAN's Liman MYS |
| CVE-2026-44930 | 9.8 | 42.1 | — | Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository |
| CVE-2026-41573 | 7.1 | 41.3 | — | OpenAM LDAP Injection via `_queryId` Parameter |
| CVE-2026-109357 | 9.2 | 38.4 | — | LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization He… |
| CVE-2026-53658 | 6.3 | 37.8 | — | Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter |
| CVE-2026-90979 | 7.3 | 37.0 | — | Apache Karaf: LDAP filter injection in JAAS LDAP login modules |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 8 |
| red hat | 4 |
| legion of the bouncy castle | 2 |
| openidentityplatform | 2 |
| dell | 1 |
| drupal | 1 |
| eleveo | 1 |
| esri | 1 |
| finsys | 1 |
| frappe | 1 |
| glpi-project | 1 |
| havelsan | 1 |
| hyperledger | 1 |
| jenkins project | 1 |
| librenms | 1 |
