CWE-287 · Improper Authentication (page 10)
Page 10 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34990 | High | 7.8 | 2026-04-03 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user ca… |
CVE-2026-33175 | High | 8.8 | 2026-04-03 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass v… |
CVE-2017-20237 | Critical | 9.8 | 2026-04-03 | Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthen… |
CVE-2026-32173 | High | 8.6 | 2026-04-03 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. |
CVE-2026-34834 | High | 7.5 | 2026-04-02 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned… |
CVE-2024-14034 | Critical | 9.8 | 2026-04-02 | Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated… |
CVE-2026-34736 | Medium | 5.3 | 2026-04-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated att… |
CVE-2026-34121 | High | 8.8 | 2026-04-02 | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent… |
CVE-2026-33746 | Critical | 9.8 | 2026-04-02 | Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify… |
CVE-2026-5320 | High | 7.3 | 2026-04-02 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the compon… |
CVE-2026-4101 | High | 8.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-34873 | Critical | 9.1 | 2026-04-01 | An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session. |
CVE-2026-34531 | Medium | 6.5 | 2026-04-01 | Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request t… |
CVE-2026-34072 | High | 8.3 | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentica… |
CVE-2026-4829 | Medium | 5.4 | 2026-04-01 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as o… |
CVE-2025-15484 | Critical | 9.1 | 2026-04-01 | The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated req… |
CVE-2025-71279 | Critical | 9.8 | 2026-04-01 | XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of… |
CVE-2026-34204 | High | 7.1 | 2026-03-31 | MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated… |
CVE-2026-31946 | Critical | 9.8 | 2026-03-30 | OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, Op… |
CVE-2026-0558 | Critical | 9.8 | 2026-03-29 | A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract… |
CVE-2026-5000 | High | 7.3 | 2026-03-28 | A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file bac… |
CVE-2026-34389 | Medium | 6.5 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during… |
CVE-2026-4959 | High | 7.3 | 2026-03-27 | A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the compone… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-33898 | High | 8.8 | 2026-03-27 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authenticat… |
CVE-2026-4831 | Low | 3.7 | 2026-03-26 | A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.clas… |
CVE-2026-33248 | Medium | 4.2 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for clien… |
CVE-2026-33246 | Medium | 6.4 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, p… |
CVE-2026-33665 | High | 7.5 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP… |
CVE-2026-33215 | Medium | 6.5 | 2026-03-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to ver… |
CVE-2026-33322 | Critical | 9.8 | 2026-03-24 | MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerab… |
CVE-2026-33314 | Medium | 6.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check d… |
CVE-2026-33409 | Critical | 9.1 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authent… |
CVE-2026-33473 | Medium | 5.7 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have the… |
CVE-2026-4021 | High | 8.1 | 2026-03-24 | The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1… |
CVE-2026-32879 | Medium | 4.9 | 2026-03-23 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the univer… |
CVE-2026-33716 | Critical | 9.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-4592 | Medium | 5.6 | 2026-03-23 | A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/… |
CVE-2026-4587 | Low | 3.7 | 2026-03-23 | A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handl… |
CVE-2026-4583 | Medium | 5.0 | 2026-03-23 | A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth H… |
CVE-2026-4582 | Medium | 5.0 | 2026-03-23 | A security vulnerability has been detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2026-4562 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component… |
CVE-2026-2756 | Medium | 5.0 | 2026-03-21 | A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipula… |
CVE-2026-32305 | Medium | 5.3 | 2026-03-20 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass throug… |
CVE-2026-33124 | High | 8.8 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to c… |
CVE-2026-4476 | Medium | 6.3 | 2026-03-20 | A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the c… |
CVE-2026-32815 | High | 7.5 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific UR… |
CVE-2026-30836 | Critical | 10.0 | 2026-03-19 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unau… |
CVE-2025-14716 | Medium | 6.5 | 2026-03-19 | Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0. |
CVE-2026-32730 | High | 8.1 | 2026-03-18 | ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/in… |
CVE-2026-33042 | Medium | 5.3 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up… |
CVE-2026-2991 | High | 7.3 | 2026-03-18 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2… |
CVE-2026-25937 | Medium | 6.5 | 2026-03-18 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's c… |
CVE-2026-4349 | Medium | 5.6 | 2026-03-17 | A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the compone… |
CVE-2026-4252 | Critical | 9.8 | 2026-03-16 | A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation l… |
CVE-2026-4187 | Medium | 5.3 | 2026-03-16 | A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInf… |
CVE-2026-21004 | Medium | 6.5 | 2026-03-16 | Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service. |
CVE-2026-32246 | High | 8.5 | 2026-03-12 | Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password veri… |
CVE-2026-32136 | Critical | 9.8 | 2026-03-11 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in A… |
CVE-2026-1524 | Critical | 9.8 | 2026-03-11 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions… |
CVE-2026-23813 | Critical | 9.8 | 2026-03-11 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to ci… |
CVE-2026-30967 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authenti… |
CVE-2026-30949 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authent… |
CVE-2026-29792 | Critical | 9.8 | 2026-03-10 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attac… |
CVE-2026-26141 | High | 7.8 | 2026-03-10 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2026-26128 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-24294 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-0953 | Critical | 9.8 | 2026-03-10 | The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is d… |
CVE-2025-68402 | | 2026-03-09 | FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is curren… | |
CVE-2026-3794 | High | 7.3 | 2026-03-09 | A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API… |
CVE-2026-3739 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/s… |
CVE-2026-30863 | Critical | 9.8 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google… |
CVE-2026-30851 | High | 8.1 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-… |
CVE-2026-29193 | High | 8.2 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login be… |
CVE-2026-30223 | High | 8.8 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJw… |
CVE-2026-30831 | Critical | 9.8 | 2026-03-06 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a… |
CVE-2026-28514 | Critical | 9.8 | 2026-03-06 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a… |
CVE-2026-28800 | Medium | 6.4 | 2026-03-06 | Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-priva… |
CVE-2026-28787 | High | 8.2 | 2026-03-06 | OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store th… |
CVE-2026-28428 | Medium | 5.3 | 2026-03-06 | Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic al… |
CVE-2026-29093 | High | 8.1 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0… |
CVE-2026-28471 | Medium | 5.3 | 2026-03-05 | OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be b… |
CVE-2026-3224 | Critical | 9.8 | 2026-03-03 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to… |
CVE-2026-24898 | Critical | 10.0 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vu… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-28408 | Critical | 9.8 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's ce… |
CVE-2026-27939 | High | 8.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users… |
CVE-2026-1305 | Medium | 5.3 | 2026-02-27 | The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed pe… |
CVE-2026-28215 | Critical | 9.1 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configur… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2026-26077 | Medium | 6.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, P… |
CVE-2026-27968 | Medium | 4.3 | 2026-02-26 | Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() ver… |
CVE-2026-3194 | Medium | 4.5 | 2026-02-25 | A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passph… |
CVE-2026-3192 | Medium | 5.6 | 2026-02-25 | A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the compon… |
CVE-2026-20129 | Critical | 9.8 | 2026-02-25 | A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected s… |
CVE-2026-20127 | Critical | 10.0 | 2026-02-25 | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vMana… |
CVE-2026-27611 | Medium | 6.5 | 2026-02-25 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, t… |
CVE-2026-24241 | Medium | 4.3 | 2026-02-24 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A suc… |
CVE-2026-3053 | High | 7.3 | 2026-02-24 | A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/confi… |