CVE-2026-88101 | High | 7.8 | 2026-10-13 | Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. |
CVE-2026-85939 | Medium | 5.3 | 2026-10-13 | Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-85922 | High | 7.4 | 2026-10-13 | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-85376 | High | 7.8 | 2026-10-13 | Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
CVE-2026-85328 | High | 7.0 | 2026-10-13 | Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-85323 | Medium | 6.8 | 2026-10-13 | Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. |
CVE-2026-83840 | High | 7.8 | 2026-10-13 | Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2026-83681 | Medium | 5.5 | 2026-10-13 | Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally. |
CVE-2026-83674 | High | 8.1 | 2026-10-13 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-83657 | Medium | 5.5 | 2026-10-13 | Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
CVE-2026-83586 | High | 7.8 | 2026-10-13 | Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-83511 | High | 7.4 | 2026-10-13 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-70005 | Medium | 5.9 | 2026-10-13 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69982 | Medium | 5.9 | 2026-10-13 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69802 | High | 8.1 | 2026-10-13 | Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. |
CVE-2026-96940 | High | 8.8 | 2026-10-02 | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-93355 | High | 8.1 | 2026-09-28 | LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any e… |
CVE-2026-92289 | Critical | 9.1 | 2026-09-25 | Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPoint… |
CVE-2026-92288 | Critical | 9.1 | 2026-09-25 | Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndP… |
CVE-2026-94455 | High | 7.1 | 2026-09-22 | An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only… |
CVE-2026-77483 | High | 8.8 | 2026-09-08 | Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-73025 | Critical | 9.8 | 2026-09-08 | Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-62895 | High | 8.8 | 2026-09-08 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-73819 | Critical | 9.8 | 2026-08-31 | The affected Ebyte
product's vendor configuration utility permits access to administrative
functions without verifying the operator's identity under certain… |
CVE-2026-44476 | | | 2026-08-25 | Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public… |
CVE-2026-65098 | High | 8.1 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploi… |
CVE-2026-68067 | Critical | 9.8 | 2026-08-11 | The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching… |
CVE-2026-59135 | Medium | 5.5 | 2026-08-11 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
CVE-2026-59554 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. |
CVE-2026-50756 | High | 7.5 | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component |
CVE-2026-55040 | Critical | 9.1 | 2026-07-14 | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-10714 | | | 2026-07-14 | A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. T… |
CVE-2026-57352 | Medium | 4.8 | 2026-07-02 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions. |
CVE-2026-0274 | Critical | 9.1 | 2026-06-10 | An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker… |
CVE-2026-6274 | Critical | 9.8 | 2026-06-05 | Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline… |
CVE-2026-44237 | High | 8.1 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during toke… |
CVE-2026-49323 | Medium | 4.3 | 2026-05-29 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year… |
CVE-2026-49322 | Medium | 4.3 | 2026-05-29 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with… |
CVE-2026-40417 | High | 7.8 | 2026-05-12 | Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally. |
CVE-2026-0204 | High | 8.0 | 2026-04-29 | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. |
CVE-2025-70994 | High | 7.3 | 2026-04-23 | Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV15… |
CVE-2026-6886 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attacke… |
CVE-2026-4924 | High | 8.2 | 2026-04-01 | Improper
authentication in the two-factor authentication (2FA) feature in
Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid
crede… |
CVE-2026-4828 | High | 8.2 | 2026-04-01 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… |
CVE-2026-32497 | Medium | 5.3 | 2026-03-25 | Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a… |
CVE-2025-62844 | Medium | 5.5 | 2026-03-20 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to ga… |
CVE-2026-27478 | Critical | 9.1 | 2026-03-11 | Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog… |
CVE-2026-28710 | Critical | 9.8 | 2026-03-06 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows… |
CVE-2025-15595 | High | 7.8 | 2026-03-03 | Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions. |
CVE-2026-1693 | High | 7.5 | 2026-02-26 | The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue f… |
CVE-2025-30412 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-30411 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-57713 | High | 7.5 | 2026-02-11 | A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive infor… |
CVE-2025-40554 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific a… |
CVE-2025-40552 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute acti… |
CVE-2023-53894 | Critical | 9.8 | 2025-12-16 | phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. At… |
CVE-2025-63807 | Critical | 9.8 | 2025-11-20 | An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code g… |
CVE-2025-12871 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and us… |
CVE-2025-12870 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administr… |
CVE-2025-11084 | | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing t… |
CVE-2025-59249 | High | 8.8 | 2025-10-14 | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-49201 | High | 8.1 | 2025-10-14 | A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1… |
CVE-2025-30468 | Medium | 6.5 | 2025-09-15 | This issue was addressed through improved state management. This issue is fixed in iOS 26 and iPadOS 26. Private Browsing tabs may be accessed without authenti… |
CVE-2025-50173 | High | 7.8 | 2025-08-12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-47995 | Medium | 6.5 | 2025-07-18 | Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-1727 | High | 8.1 | 2025-07-10 | The protocol used for remote linking over RF for End-of-Train and
Head-of-Train (also known as a FRED) relies on a BCH checksum for packet
creation. It is po… |
CVE-2025-7326 | High | 7.0 | 2025-07-08 | Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) so… |
CVE-2025-47479 | Medium | 5.3 | 2025-07-04 | Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a throug… |
CVE-2025-5484 | High | 8.3 | 2025-06-12 | A username and password are required to authenticate to the central
SinoTrack device management interface. The username for all devices is
an identifier prin… |
CVE-2024-32119 | Medium | 4.8 | 2025-06-10 | An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowle… |
CVE-2025-0605 | Medium | 4.6 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access contro… |
CVE-2025-32885 | Medium | 6.5 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v… |
CVE-2025-39596 | Critical | 9.8 | 2025-04-17 | Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8. |
CVE-2025-27740 | High | 8.8 | 2025-04-08 | Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26635 | Medium | 6.5 | 2025-04-08 | Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network. |
CVE-2024-54092 | Critical | 9.8 | 2025-04-08 | A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Indust… |
CVE-2024-45551 | Medium | 6.2 | 2025-04-07 | Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to… |
CVE-2025-29991 | Low | 2.2 | 2025-04-03 | Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/… |
CVE-2025-31676 | High | 8.8 | 2025-03-31 | Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. |
CVE-2025-29994 | | | 2025-03-13 | This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with… |
CVE-2025-24070 | High | 7.0 | 2025-03-11 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-1293 | High | 8.2 | 2025-02-20 | Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. T… |
CVE-2024-52541 | High | 8.2 | 2025-02-19 | Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerabili… |
CVE-2025-1387 | Critical | 9.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user. |
CVE-2025-26343 | High | 8.1 | 2025-02-12 | A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote at… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-21552 | Medium | 6.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are… |
CVE-2024-50563 | High | 7.3 | 2025-01-16 | A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 throu… |
CVE-2024-48886 | Critical | 9.0 | 2025-01-14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7… |
CVE-2024-13239 | Critical | 9.8 | 2025-01-09 | Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): fro… |
CVE-2024-47397 | High | 7.5 | 2024-12-18 | Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exp… |
CVE-2023-41862 | Medium | 5.3 | 2024-12-13 | Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0. |
CVE-2024-49019 | High | 7.8 | 2024-11-12 | Active Directory Certificate Services Elevation of Privilege Vulnerability |
CVE-2024-45367 | Critical | 9.1 | 2024-10-03 | The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a pa… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible
to inject any custom message with any GID and Callsign using a software
defined radio… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it
possible to inject any custom message with any GID and Callsign using a
software define… |
CVE-2024-8322 | Medium | 4.3 | 2024-09-10 | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted… |
CVE-2024-38239 | High | 7.2 | 2024-09-10 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2024-38182 | Critical | 9.0 | 2024-07-31 | Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network. |
CVE-2024-6580 | Medium | 6.5 | 2024-07-08 | The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or… |