CVE-2026-0636

MediumCVSS 6.5/10Last modified Sep 18, 2026

Description

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).

This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-90

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-06374.4When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging oc CVE-2026-06395.5in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2026-06409.8A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a man CVE-2026-06418.8A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the CVE-2026-06426.1A vulnerability was detected in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file CVE-2026-06439.8A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?CVE-2026-06468.7A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulne CVE-2026-06478.8An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenti CVE-2026-06486.3The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers CVE-2026-06494.7A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Ut CVE-2026-06509.3OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper hand CVE-2026-06517.8A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GE