CVE-2026-106488 | High | 8.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by… |
CVE-2026-106460 | Medium | 6.8 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently… |
CVE-2026-106457 | Medium | 6.8 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider pac… |
CVE-2026-73278 | | | 2026-10-06 | Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able… |
CVE-2026-105305 | Medium | 5.4 | 2026-10-06 | A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited in… |
CVE-2026-94271 | Medium | 5.3 | 2026-10-06 | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkou… |
CVE-2026-94270 | Medium | 5.3 | 2026-10-06 | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verif… |
CVE-2026-59358 | | | 2026-10-06 | Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to… |
CVE-2026-105704 | High | 7.3 | 2026-10-06 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulatio… |
CVE-2026-105486 | High | 7.3 | 2026-10-06 | A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API… |
CVE-2026-82988 | High | 7.5 | 2026-10-06 | There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unp… |
CVE-2026-105640 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployme… |
CVE-2026-105639 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-ban… |
CVE-2026-79820 | Critical | 9.0 | 2026-10-05 | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware. |
CVE-2026-105307 | High | 7.3 | 2026-10-05 | A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Pe… |
CVE-2026-105170 | High | 7.3 | 2026-10-05 | A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Aff… |
CVE-2026-105213 | High | 8.2 | 2026-10-04 | ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of… |
CVE-2026-105212 | High | 7.5 | 2026-10-04 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authent… |
CVE-2026-105210 | High | 8.2 | 2026-10-04 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initializa… |
CVE-2026-105133 | High | 7.3 | 2026-10-04 | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the c… |
CVE-2026-71885 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_k… |
CVE-2026-97343 | Medium | 4.3 | 2026-10-03 | The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Accou… |
CVE-2026-91078 | High | 8.2 | 2026-10-03 | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be chan… |
CVE-2026-103514 | High | 7.5 | 2026-10-03 | The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's… |
CVE-2026-104638 | Medium | 5.3 | 2026-10-02 | A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is… |
CVE-2026-97637 | Critical | 9.8 | 2026-10-02 | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2… |
CVE-2026-81740 | Medium | 5.3 | 2026-10-02 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret ke… |
CVE-2026-19660 | Critical | 9.8 | 2026-10-02 | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` func… |
CVE-2026-14378 | Critical | 9.8 | 2026-10-02 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3… |
CVE-2026-102369 | | | 2026-10-01 | Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthentica… |
CVE-2026-94276 | | | 2026-10-01 | Improper Authentication vulnerability in Apache APISIX.
On a route using openid-connect plugin with remote introspection against an authorization server that… |
CVE-2026-103264 | Critical | 9.1 | 2026-10-01 | Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tok… |
CVE-2026-75957 | Critical | 9.8 | 2026-10-01 | The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includ… |
CVE-2026-103651 | | | 2026-10-01 | MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token… |
CVE-2026-103539 | Medium | 5.4 | 2026-10-01 | A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantb… |
CVE-2026-103538 | Medium | 6.5 | 2026-10-01 | A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/mai… |
CVE-2026-103536 | High | 7.3 | 2026-10-01 | A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/mai… |
CVE-2026-102128 | High | 7.5 | 2026-09-30 | An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not aut… |
CVE-2026-102106 | Critical | 9.1 | 2026-09-30 | Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not… |
CVE-2026-88920 | Critical | 9.8 | 2026-09-30 | An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a craft… |
CVE-2026-100143 | Medium | 6.5 | 2026-09-30 | The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address suppli… |
CVE-2026-76730 | Medium | 6.5 | 2026-09-29 | An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to ci… |
CVE-2026-76726 | High | 8.1 | 2026-09-29 | An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access… |
CVE-2026-76725 | Critical | 9.6 | 2026-09-29 | A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumve… |
CVE-2026-92227 | High | 7.5 | 2026-09-29 | Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an remem… |
CVE-2026-101269 | | | 2026-09-29 | The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-base… |
CVE-2026-102248 | High | 7.3 | 2026-09-29 | A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The ma… |
CVE-2026-102245 | High | 7.3 | 2026-09-29 | A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleb… |
CVE-2026-101281 | High | 7.3 | 2026-09-29 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the… |
CVE-2026-101280 | High | 7.3 | 2026-09-29 | A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Reco… |
CVE-2026-102364 | Medium | 5.4 | 2026-09-29 | mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing thei… |
CVE-2026-101077 | Critical | 10.0 | 2026-09-28 | A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missi… |
CVE-2026-101073 | High | 8.3 | 2026-09-28 | A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Perform… |
CVE-2026-52749 | | | 2026-09-28 | The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain… |
CVE-2026-101004 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/… |
CVE-2026-100903 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST… |
CVE-2026-100886 | Critical | 10.0 | 2026-09-27 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the componen… |
CVE-2026-100876 | Medium | 6.3 | 2026-09-27 | A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the fil… |
CVE-2026-101050 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is emp… |
CVE-2026-101049 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attack… |
CVE-2026-101042 | Medium | 6.4 | 2026-09-27 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Go… |
CVE-2026-100871 | High | 8.8 | 2026-09-27 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API… |
CVE-2026-89136 | | | 2026-09-27 | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allo… |
CVE-2026-94419 | Medium | 5.4 | 2026-09-27 | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} in… |
CVE-2026-100746 | High | 7.3 | 2026-09-27 | A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the com… |
CVE-2026-85984 | Critical | 9.8 | 2026-09-26 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter i… |
CVE-2026-100709 | High | 7.5 | 2026-09-26 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-to… |
CVE-2026-100684 | High | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing u… |
CVE-2026-100607 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to auth… |
CVE-2026-100606 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an… |
CVE-2026-97063 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without… |
CVE-2026-84458 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zamm… |
CVE-2026-56727 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the g… |
CVE-2026-97879 | Medium | 5.3 | 2026-09-25 | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the… |
CVE-2026-97878 | High | 7.3 | 2026-09-25 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid… |
CVE-2026-97864 | Medium | 5.3 | 2026-09-25 | A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAja… |
CVE-2026-97846 | Medium | 6.8 | 2026-09-25 | Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding… |
CVE-2026-81473 | High | 8.1 | 2026-09-24 | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could… |
CVE-2026-56792 | Medium | 4.4 | 2026-09-24 | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could… |
CVE-2026-85056 | High | 8.2 | 2026-09-24 | ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can… |
CVE-2026-57178 | High | 7.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou… |
CVE-2026-57175 | Medium | 6.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consume… |
CVE-2026-97231 | High | 7.3 | 2026-09-24 | A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Inter… |
CVE-2026-94612 | High | 7.4 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validi… |
CVE-2026-94606 | High | 8.9 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or… |
CVE-2026-75907 | High | 7.5 | 2026-09-24 | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is… |
CVE-2026-56737 | High | 8.1 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verificat… |
CVE-2026-78308 | Critical | 9.8 | 2026-09-24 | Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.
This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-19125 | High | 8.1 | 2026-09-23 | The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_lo… |
CVE-2026-95676 | | | 2026-09-23 | A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass… |
CVE-2026-84091 | Medium | 5.3 | 2026-09-23 | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before… |
CVE-2026-96445 | Medium | 6.8 | 2026-09-23 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates speci… |
CVE-2026-86248 | Critical | 9.8 | 2026-09-23 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.
This issue affects Apache… |
CVE-2026-75973 | High | 7.3 | 2026-09-23 | Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and mu… |
CVE-2026-96456 | Medium | 6.3 | 2026-09-23 | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an a… |
CVE-2026-31377 | High | 7.5 | 2026-09-23 | An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata s… |
CVE-2026-82843 | Critical | 9.0 | 2026-09-23 | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization g… |
CVE-2026-18074 | High | 8.2 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and m… |
CVE-2026-77244 | Critical | 10.0 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests witho… |
CVE-2026-65121 | High | 8.2 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of th… |