CVE-2026-75774 | Low | 3.7 | 2026-08-18 | A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the co… |
CVE-2025-27621 | | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default us… |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-19977 | Critical | 10.0 | 2026-08-17 | A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation… |
CVE-2026-19974 | Medium | 5.6 | 2026-08-17 | A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/… |
CVE-2026-19971 | Medium | 4.7 | 2026-08-17 | A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manip… |
CVE-2026-19714 | Critical | 9.1 | 2026-08-16 | The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to… |
CVE-2026-15384 | Medium | 5.7 | 2026-08-16 | The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops atta… |
CVE-2026-19924 | Critical | 9.8 | 2026-08-16 | A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the componen… |
CVE-2026-73054 | High | 7.5 | 2026-08-15 | SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters betwe… |
CVE-2026-18216 | Medium | 6.5 | 2026-08-15 | The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one sit… |
CVE-2026-15341 | Critical | 9.8 | 2026-08-15 | The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4… |
CVE-2026-15303 | Critical | 9.8 | 2026-08-15 | The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat… |
CVE-2026-74240 | Medium | 5.4 | 2026-08-14 | A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues relate… |
CVE-2026-17182 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validat… |
CVE-2026-17175 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. |
CVE-2026-16905 | Medium | 5.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication. |
CVE-2026-48528 | Critical | 9.8 | 2026-08-14 | Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated… |
CVE-2026-16739 | Medium | 5.9 | 2026-08-14 | The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the target… |
CVE-2026-73840 | Medium | 5.3 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in in… |
CVE-2026-73302 | | | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email wi… |
CVE-2026-19749 | Low | 3.7 | 2026-08-13 | A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability… |
CVE-2026-17101 | High | 8.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication. |
CVE-2026-17099 | High | 7.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication. |
CVE-2026-17075 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of au… |
CVE-2026-73655 | High | 7.4 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/goo… |
CVE-2026-16867 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authenticati… |
CVE-2026-17197 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity. |
CVE-2026-59500 | Critical | 10.0 | 2026-08-13 | CWE-287: Improper Authentication |
CVE-2026-14182 | Critical | 9.8 | 2026-08-13 | The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a… |
CVE-2026-47718 | | | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token req… |
CVE-2026-73501 | Critical | 9.1 | 2026-08-12 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a… |
CVE-2024-27253 | Critical | 10.0 | 2026-08-12 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. |
CVE-2026-12359 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-11923 | High | 7.4 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-42018 | High | 7.5 | 2026-08-12 | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive… |
CVE-2026-68760 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may bypass authentication under specific cache conditions. |
CVE-2026-50561 | Critical | 9.4 | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mec… |
CVE-2026-26035 | Critical | 9.8 | 2026-08-12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-18961 | High | 8.1 | 2026-08-12 | The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unveri… |
CVE-2026-73241 | | | 2026-08-11 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-su… |
CVE-2026-71467 | High | 7.5 | 2026-08-11 | A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upg… |
CVE-2026-73085 | | | 2026-08-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the re… |
CVE-2026-62827 | High | 8.8 | 2026-08-11 | Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-20891 | | | 2026-08-11 | Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivi… |
CVE-2026-20885 | | | 2026-08-11 | Improper authentication in the Intel(R) TDX module for some Intel(R) platforms within Ring 0: Trust Domain may allow an information disclosure and escalation o… |
CVE-2026-20752 | | | 2026-08-11 | Improper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary wi… |
CVE-2026-12571 | Critical | 9.8 | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover. |
CVE-2026-72922 | High | 8.2 | 2026-08-11 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_p… |
CVE-2026-51584 | Critical | 9.8 | 2026-08-11 | An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/a… |
CVE-2026-72533 | High | 8.8 | 2026-08-11 | An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via… |
CVE-2026-72917 | Medium | 5.9 | 2026-08-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's… |
CVE-2026-40920 | Critical | 9.8 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this iss… |
CVE-2026-18960 | Medium | 5.4 | 2026-08-10 | The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an appl… |
CVE-2026-18786 | High | 8.8 | 2026-08-10 | The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentica… |
CVE-2026-18469 | High | 8.1 | 2026-08-10 | The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the ver… |
CVE-2026-18468 | High | 8.1 | 2026-08-10 | The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that c… |
CVE-2026-16299 | Critical | 9.8 | 2026-08-10 | The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the p… |
CVE-2026-16257 | High | 8.2 | 2026-08-10 | The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed… |
CVE-2026-13600 | High | 8.1 | 2026-08-10 | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authenticat… |
CVE-2026-19342 | High | 7.3 | 2026-08-09 | A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Perfor… |
CVE-2026-15038 | Critical | 9.8 | 2026-08-09 | The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-manageme… |
CVE-2026-16282 | Medium | 5.3 | 2026-08-08 | The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price… |
CVE-2026-16269 | Medium | 4.8 | 2026-08-08 | The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authent… |
CVE-2026-48039 | Critical | 9.1 | 2026-08-07 | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `… |
CVE-2026-56793 | High | 7.7 | 2026-08-07 | Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote ac… |
CVE-2026-16030 | High | 8.1 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, a… |
CVE-2026-14205 | Critical | 9.8 | 2026-08-07 | The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the… |
CVE-2026-62896 | Critical | 9.6 | 2026-08-07 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56162 | Critical | 10.0 | 2026-08-07 | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-71326 | | | 2026-08-06 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/bas… |
CVE-2026-65400 | Critical | 9.8 | 2026-08-06 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An… |
CVE-2026-64665 | High | 8.1 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not g… |
CVE-2026-48087 | Critical | 9.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at… |
CVE-2026-14547 | Medium | 5.3 | 2026-08-06 | The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property re… |
CVE-2026-15459 | High | 8.1 | 2026-08-06 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to t… |
CVE-2026-18990 | High | 7.3 | 2026-08-06 | A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The m… |
CVE-2026-9192 | Critical | 9.8 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker t… |
CVE-2026-71277 | Critical | 9.1 | 2026-08-05 | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates… |
CVE-2026-16055 | High | 7.5 | 2026-08-05 | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentic… |
CVE-2026-16036 | High | 7.5 | 2026-08-05 | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target acco… |
CVE-2026-15372 | High | 7.5 | 2026-08-05 | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing a… |
CVE-2026-15210 | Critical | 9.1 | 2026-08-05 | The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-tim… |
CVE-2026-18816 | Medium | 5.0 | 2026-08-04 | A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_aut… |
CVE-2026-70482 | High | 8.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{p… |
CVE-2026-18810 | High | 7.3 | 2026-08-04 | A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads… |
CVE-2026-63456 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-58075 | | | 2026-08-04 | A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally. |
CVE-2026-18759 | | | 2026-08-04 | The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encry… |
CVE-2026-11366 | Low | 3.7 | 2026-08-04 | The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsig… |
CVE-2026-8508 | Medium | 6.5 | 2026-08-04 | An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacke… |
CVE-2026-18610 | Medium | 5.3 | 2026-08-03 | A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.aspx. The manipulation results in improper… |
CVE-2026-18651 | Medium | 5.4 | 2026-08-03 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account… |
CVE-2026-14557 | Critical | 9.1 | 2026-08-03 | The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification… |
CVE-2026-16261 | High | 7.5 | 2026-08-02 | The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authen… |
CVE-2026-15206 | High | 7.5 | 2026-08-02 | The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker… |
CVE-2026-12586 | High | 8.1 | 2026-08-02 | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce… |
CVE-2026-67335 | Medium | 5.3 | 2026-08-01 | better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Atta… |
CVE-2026-67327 | High | 8.3 | 2026-08-01 | better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hi… |