CVE-2026-75903 | High | 8.1 | 2026-10-16 | The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protec… |
CVE-2026-103895 | High | 8.1 | 2026-10-16 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5… |
CVE-2026-105034 | High | 8.2 | 2026-10-15 | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker ca… |
CVE-2026-104198 | Medium | 5.3 | 2026-10-15 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token… |
CVE-2026-57183 | Medium | 6.1 | 2026-10-15 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts… |
CVE-2026-102631 | | | 2026-10-15 | In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but fa… |
CVE-2026-45451 | High | 8.3 | 2026-10-15 | : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniS… |
CVE-2026-110864 | High | 7.4 | 2026-10-14 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to… |
CVE-2026-110863 | High | 8.1 | 2026-10-14 | Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other u… |
CVE-2026-110862 | Critical | 9.1 | 2026-10-14 | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by… |
CVE-2026-69191 | Medium | 5.4 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, di… |
CVE-2026-104108 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC id… |
CVE-2026-104105 | Medium | 6.4 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is… |
CVE-2026-110669 | Medium | 6.5 | 2026-10-14 | A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such m… |
CVE-2026-109506 | | | 2026-10-14 | Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated att… |
CVE-2026-102899 | | | 2026-10-14 | Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a… |
CVE-2026-107350 | High | 8.8 | 2026-10-14 | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other… |
CVE-2026-101954 | Critical | 9.8 | 2026-10-14 | An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved a… |
CVE-2026-101986 | Critical | 9.8 | 2026-10-14 | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web… |
CVE-2026-101956 | Critical | 9.8 | 2026-10-14 | An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execut… |
CVE-2026-102893 | | | 2026-10-14 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim t… |
CVE-2026-100169 | | | 2026-10-14 | Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to o… |
CVE-2026-100163 | High | 7.4 | 2026-10-14 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to… |
CVE-2026-87974 | Medium | 5.3 | 2026-10-14 | The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its defa… |
CVE-2026-110097 | High | 8.1 | 2026-10-13 | Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the… |
CVE-2026-53709 | Critical | 9.8 | 2026-10-13 | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verif… |
CVE-2026-95680 | High | 8.0 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the… |
CVE-2026-93907 | High | 8.1 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation hand… |
CVE-2026-109114 | High | 7.3 | 2026-10-13 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknow… |
CVE-2026-108972 | High | 7.3 | 2026-10-13 | A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file cont… |
CVE-2026-84312 | High | 7.1 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state… |
CVE-2026-84313 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside Re… |
CVE-2026-108921 | High | 7.3 | 2026-10-12 | A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query o… |
CVE-2026-85962 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In d… |
CVE-2026-85958 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacke… |
CVE-2026-109372 | High | 8.7 | 2026-10-12 | ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion… |
CVE-2026-109313 | High | 8.1 | 2026-10-12 | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authenticat… |
CVE-2026-109312 | High | 8.1 | 2026-10-12 | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pendin… |
CVE-2026-108907 | Critical | 10.0 | 2026-10-12 | A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper… |
CVE-2026-108818 | High | 7.3 | 2026-10-12 | A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulati… |
CVE-2026-109082 | Medium | 6.8 | 2026-10-12 | A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component hand… |
CVE-2026-108865 | High | 8.2 | 2026-10-11 | AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAu… |
CVE-2026-88827 | High | 8.8 | 2026-10-11 | The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account… |
CVE-2026-84737 | Critical | 9.8 | 2026-10-11 | The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to… |
CVE-2026-84734 | Critical | 9.8 | 2026-10-11 | The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before aut… |
CVE-2026-108522 | High | 8.3 | 2026-10-11 | A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Perfo… |
CVE-2026-108707 | Critical | 9.8 | 2026-10-11 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API en… |
CVE-2026-108548 | High | 7.3 | 2026-10-10 | AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without valid… |
CVE-2026-104803 | Critical | 9.8 | 2026-10-10 | The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters… |
CVE-2026-104759 | High | 8.1 | 2026-10-10 | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in a… |
CVE-2026-94256 | High | 8.1 | 2026-10-10 | The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauth… |
CVE-2026-107120 | Medium | 5.3 | 2026-10-10 | The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which rel… |
CVE-2026-104797 | High | 8.1 | 2026-10-10 | The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all ve… |
CVE-2026-104732 | Critical | 9.8 | 2026-10-10 | The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists beca… |
CVE-2026-62367 | | | 2026-10-09 | Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback`… |
CVE-2026-108157 | High | 8.1 | 2026-10-09 | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts… |
CVE-2026-107808 | High | 8.1 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion… |
CVE-2026-108108 | High | 7.1 | 2026-10-09 | PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the… |
CVE-2026-107910 | High | 8.1 | 2026-10-09 | An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attac… |
CVE-2026-105672 | | | 2026-10-08 | TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerability in the
HTTPS JSON API dispatcher on TCP port 443. An attacker on the adja… |
CVE-2026-19494 | High | 8.1 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass secur… |
CVE-2026-19491 | Critical | 9.1 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due… |
CVE-2026-16823 | Critical | 9.1 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictio… |
CVE-2026-14502 | Critical | 9.8 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacke… |
CVE-2026-105832 | Medium | 4.3 | 2026-10-08 | EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication… |
CVE-2026-103646 | Critical | 9.8 | 2026-10-08 | The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing… |
CVE-2026-107228 | Medium | 6.8 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14… |
CVE-2026-46437 | Medium | 4.8 | 2026-10-07 | wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bea… |
CVE-2026-107180 | | | 2026-10-07 | On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only t… |
CVE-2026-107162 | Medium | 6.8 | 2026-10-07 | Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or… |
CVE-2026-83540 | High | 8.8 | 2026-10-07 | When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not… |
CVE-2026-101023 | Critical | 9.1 | 2026-10-06 | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh t… |
CVE-2026-106488 | High | 8.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by… |
CVE-2026-106460 | Medium | 6.8 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently… |
CVE-2026-106457 | Medium | 6.8 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider pac… |
CVE-2026-96404 | High | 8.1 | 2026-10-06 | When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the… |
CVE-2026-79796 | Critical | 9.8 | 2026-10-06 | Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to c… |
CVE-2026-76752 | Critical | 9.8 | 2026-10-06 | Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation… |
CVE-2026-76743 | Critical | 9.8 | 2026-10-06 | A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existin… |
CVE-2026-73278 | Critical | 9.8 | 2026-10-06 | Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able… |
CVE-2026-105305 | Medium | 5.4 | 2026-10-06 | A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited in… |
CVE-2026-94271 | Medium | 5.3 | 2026-10-06 | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkou… |
CVE-2026-94270 | Medium | 5.3 | 2026-10-06 | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verif… |
CVE-2026-59358 | | | 2026-10-06 | Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to… |
CVE-2026-105704 | High | 7.3 | 2026-10-06 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulatio… |
CVE-2026-105486 | High | 7.3 | 2026-10-06 | A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API… |
CVE-2026-82988 | High | 7.5 | 2026-10-06 | There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unp… |
CVE-2026-105640 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployme… |
CVE-2026-105639 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-ban… |
CVE-2026-79820 | Critical | 9.0 | 2026-10-05 | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware. |
CVE-2026-105307 | High | 7.3 | 2026-10-05 | A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Pe… |
CVE-2026-105170 | High | 7.3 | 2026-10-05 | A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Aff… |
CVE-2026-105213 | High | 8.2 | 2026-10-04 | ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of… |
CVE-2026-105212 | High | 7.5 | 2026-10-04 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authent… |
CVE-2026-105210 | High | 8.2 | 2026-10-04 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initializa… |
CVE-2026-105133 | High | 7.3 | 2026-10-04 | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the c… |
CVE-2026-71885 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_k… |
CVE-2026-97343 | Medium | 4.3 | 2026-10-03 | The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Accou… |
CVE-2026-91078 | High | 8.2 | 2026-10-03 | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be chan… |
CVE-2026-103514 | High | 7.5 | 2026-10-03 | The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's… |