CVE-2026-68067 | Critical | 9.8 | 2026-08-11 | The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching… |
CVE-2026-59135 | Medium | 5.5 | 2026-08-11 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
CVE-2026-59554 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. |
CVE-2026-50756 | High | 7.5 | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component |
CVE-2026-55040 | Critical | 9.1 | 2026-07-14 | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-10714 | | | 2026-07-14 | A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. T… |
CVE-2026-57352 | Medium | 4.8 | 2026-07-02 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions. |
CVE-2026-0274 | Critical | 9.1 | 2026-06-10 | An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker… |
CVE-2026-6274 | Critical | 9.8 | 2026-06-05 | Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline… |
CVE-2026-44237 | High | 8.1 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during toke… |
CVE-2026-49323 | Medium | 4.3 | 2026-05-29 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year… |
CVE-2026-49322 | Medium | 4.3 | 2026-05-29 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with… |
CVE-2026-40417 | High | 7.8 | 2026-05-12 | Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally. |
CVE-2026-0204 | High | 8.0 | 2026-04-29 | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. |
CVE-2025-70994 | High | 7.3 | 2026-04-23 | Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV15… |
CVE-2026-6886 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attacke… |
CVE-2026-4924 | High | 8.2 | 2026-04-01 | Improper
authentication in the two-factor authentication (2FA) feature in
Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid
crede… |
CVE-2026-4828 | High | 8.2 | 2026-04-01 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… |
CVE-2026-32497 | Medium | 5.3 | 2026-03-25 | Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a… |
CVE-2025-62844 | Medium | 5.5 | 2026-03-20 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to ga… |
CVE-2026-27478 | Critical | 9.1 | 2026-03-11 | Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog… |
CVE-2026-28710 | Critical | 9.8 | 2026-03-06 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows… |
CVE-2025-15595 | High | 7.8 | 2026-03-03 | Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions. |
CVE-2026-1693 | High | 7.5 | 2026-02-26 | The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue f… |
CVE-2025-30412 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-30411 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-57713 | High | 7.5 | 2026-02-11 | A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive infor… |
CVE-2025-40554 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific a… |
CVE-2025-40552 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute acti… |
CVE-2023-53894 | Critical | 9.8 | 2025-12-16 | phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. At… |
CVE-2025-63807 | Critical | 9.8 | 2025-11-20 | An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code g… |
CVE-2025-12871 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and us… |
CVE-2025-12870 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administr… |
CVE-2025-11084 | | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing t… |
CVE-2025-59249 | High | 8.8 | 2025-10-14 | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-49201 | High | 8.1 | 2025-10-14 | A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1… |
CVE-2025-30468 | Medium | 6.5 | 2025-09-15 | This issue was addressed through improved state management. This issue is fixed in iOS 26 and iPadOS 26. Private Browsing tabs may be accessed without authenti… |
CVE-2025-50173 | High | 7.8 | 2025-08-12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-47995 | Medium | 6.5 | 2025-07-18 | Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-1727 | High | 8.1 | 2025-07-10 | The protocol used for remote linking over RF for End-of-Train and
Head-of-Train (also known as a FRED) relies on a BCH checksum for packet
creation. It is po… |
CVE-2025-7326 | High | 7.0 | 2025-07-08 | Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) so… |
CVE-2025-47479 | Medium | 5.3 | 2025-07-04 | Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a throug… |
CVE-2025-5484 | High | 8.3 | 2025-06-12 | A username and password are required to authenticate to the central
SinoTrack device management interface. The username for all devices is
an identifier prin… |
CVE-2024-32119 | Medium | 4.8 | 2025-06-10 | An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowle… |
CVE-2025-0605 | Medium | 4.6 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access contro… |
CVE-2025-32885 | Medium | 6.5 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v… |
CVE-2025-39596 | Critical | 9.8 | 2025-04-17 | Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8. |
CVE-2025-27740 | High | 8.8 | 2025-04-08 | Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26635 | Medium | 6.5 | 2025-04-08 | Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network. |
CVE-2024-54092 | Critical | 9.8 | 2025-04-08 | A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Indust… |
CVE-2024-45551 | Medium | 6.2 | 2025-04-07 | Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to… |
CVE-2025-29991 | Low | 2.2 | 2025-04-03 | Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/… |
CVE-2025-31676 | High | 8.8 | 2025-03-31 | Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. |
CVE-2025-29994 | | | 2025-03-13 | This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with… |
CVE-2025-24070 | High | 7.0 | 2025-03-11 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-1293 | High | 8.2 | 2025-02-20 | Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. T… |
CVE-2024-52541 | High | 8.2 | 2025-02-19 | Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerabili… |
CVE-2025-1387 | Critical | 9.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user. |
CVE-2025-26343 | High | 8.1 | 2025-02-12 | A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote at… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-21552 | Medium | 6.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are… |
CVE-2024-50563 | High | 7.3 | 2025-01-16 | A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 throu… |
CVE-2024-48886 | Critical | 9.0 | 2025-01-14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7… |
CVE-2024-13239 | Critical | 9.8 | 2025-01-09 | Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): fro… |
CVE-2024-47397 | High | 7.5 | 2024-12-18 | Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exp… |
CVE-2023-41862 | Medium | 5.3 | 2024-12-13 | Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0. |
CVE-2024-49019 | High | 7.8 | 2024-11-12 | Active Directory Certificate Services Elevation of Privilege Vulnerability |
CVE-2024-45367 | Critical | 9.1 | 2024-10-03 | The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a pa… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible
to inject any custom message with any GID and Callsign using a software
defined radio… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it
possible to inject any custom message with any GID and Callsign using a
software define… |
CVE-2024-8322 | Medium | 4.3 | 2024-09-10 | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted… |
CVE-2024-38239 | High | 7.2 | 2024-09-10 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2024-38182 | Critical | 9.0 | 2024-07-31 | Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network. |
CVE-2024-6580 | Medium | 6.5 | 2024-07-08 | The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or… |
CVE-2024-39848 | Critical | 9.1 | 2024-06-29 | Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws… |
CVE-2024-29038 | Medium | 4.3 | 2024-06-28 | tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detecte… |
CVE-2024-34451 | Critical | 9.1 | 2024-06-16 | Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different v… |
CVE-2024-5891 | Medium | 4.2 | 2024-06-12 | A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having a… |
CVE-2024-35248 | High | 7.3 | 2024-06-11 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2024-36787 | High | 8.8 | 2024-06-07 | An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vec… |
CVE-2024-29837 | High | 8.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce… |
CVE-2023-49340 | Critical | 9.8 | 2024-03-09 | An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authe… |
CVE-2024-0822 | High | 7.5 | 2024-01-25 | An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in… |
CVE-2023-4094 | Medium | 6.5 | 2023-09-19 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate acco… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2022-45860 | Medium | 5.3 | 2023-05-03 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versi… |
CVE-2023-24890 | Medium | 6.5 | 2023-03-14 | Microsoft OneDrive for iOS Security Feature Bypass Vulnerability |
CVE-2022-43400 | Critical | 9.8 | 2022-10-21 | A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applicati… |