CVE-2026-113438Medium· 6.5▾ SunlitPleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Lo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
Pleasanter >= 1.1.0.0 <= 1.5.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119776Medium· 6.1frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
CVE-2026-77800High· 7.7Authentication bypass vulnerability
CVE-2026-101296Critical· 9.1Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
CVE-2026-89068High· 8.1Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-73535High· 8.8Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier
CVE-2026-108071High· 8.7Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism