CWE-287 · Improper Authentication (page 11)
Page 11 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27197 | Critical | 9.1 | 2026-02-21 | Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO imple… |
CVE-2026-27134 | High | 8.1 | 2026-02-21 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when… |
CVE-2025-70833 | Critical | 9.4 | 2026-02-20 | An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and f… |
CVE-2025-41023 | | 2026-02-19 | An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once in… | |
CVE-2025-15586 | | 2026-02-19 | OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentica… | |
CVE-2025-15581 | | 2026-02-18 | Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploit… | |
CVE-2025-7630 | Medium | 5.3 | 2026-02-18 | Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc… |
CVE-2026-1368 | High | 7.5 | 2026-02-18 | The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated… |
CVE-2026-26119 | High | 8.8 | 2026-02-17 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-25922 | High | 8.8 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signa… |
CVE-2026-25748 | High | 8.6 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using fo… |
CVE-2026-20655 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2025-68663 | Medium | 5.3 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentication mechanism tha… |
CVE-2025-65128 | High | 8.1 | 2026-02-11 | A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers… |
CVE-2025-65127 | Medium | 6.5 | 2026-02-11 | A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access a… |
CVE-2026-2249 | Critical | 9.8 | 2026-02-11 | METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-2248 | Critical | 9.8 | 2026-02-11 | METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-21508 | High | 7.0 | 2026-02-10 | Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. |
CVE-2026-23906 | Critical | 9.8 | 2026-02-10 | Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic… |
CVE-2026-25893 | Critical | 9.8 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthentic… |
CVE-2025-10463 | High | 7.3 | 2026-02-09 | Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects… |
CVE-2026-2174 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulati… |
CVE-2026-2165 | High | 7.3 | 2026-02-08 | A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-2065 | Medium | 6.3 | 2026-02-06 | A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low… |
CVE-2025-64175 | High | 8.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-ac… |
CVE-2025-70841 | Critical | 10.0 | 2026-02-03 | Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2026-1740 | High | 7.3 | 2026-02-02 | A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidde… |
CVE-2025-62349 | Medium | 6.2 | 2026-01-30 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using… |
CVE-2025-6723 | | 2026-01-30 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere w… | |
CVE-2026-22764 | Medium | 4.3 | 2026-01-29 | Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker with remote access cou… |
CVE-2025-12810 | Medium | 6.5 | 2026-01-27 | Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 1… |
CVE-2026-24003 | Medium | 4.3 | 2026-01-26 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authent… |
CVE-2026-1410 | Medium | 6.4 | 2026-01-26 | A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation res… |
CVE-2026-0633 | Low | 3.7 | 2026-01-24 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2022-25369 | Critical | 9.8 | 2026-01-23 | An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2026-24038 | High | 8.1 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be byp… |
CVE-2026-1203 | Medium | 5.6 | 2026-01-20 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php… |
CVE-2026-1202 | High | 7.3 | 2026-01-20 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginControll… |
CVE-2026-0629 | | 2026-01-16 | Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the… | |
CVE-2025-67822 | Critical | 9.4 | 2026-01-15 | A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated atta… |
CVE-2025-65397 | Medium | 6.8 | 2026-01-14 | An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with phy… |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2026-22236 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2025-67859 | | 2026-01-14 | A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This iss… | |
CVE-2025-68931 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulner… |
CVE-2026-0408 | High | 8.0 | 2026-01-13 | A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents o… |
CVE-2026-0407 | High | 8.0 | 2026-01-13 | An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethern… |
CVE-2026-0405 | High | 7.8 | 2026-01-13 | An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin. |
CVE-2025-66698 | High | 8.6 | 2026-01-13 | An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints. |
CVE-2025-69273 | High | 7.5 | 2026-01-12 | Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3… |
CVE-2026-0842 | Medium | 6.3 | 2026-01-11 | A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulat… |
CVE-2026-22594 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows sta… |
CVE-2025-68717 | Critical | 9.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/sy… |
CVE-2026-21891 | Critical | 9.4 | 2026-01-08 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks th… |
CVE-2025-15224 | Low | 3.1 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a local… |
CVE-2026-21881 | Critical | 9.1 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE… |
CVE-2025-15346 | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… | |
CVE-2026-21854 | Critical | 9.8 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows… |
CVE-2025-14942 | Critical | 9.8 | 2026-01-06 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the cl… |
CVE-2025-60534 | Critical | 9.8 | 2026-01-06 | Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-64423 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2026-21633 | High | 8.8 | 2026-01-05 | A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerabili… |
CVE-2026-0589 | High | 7.3 | 2026-01-05 | A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The… |
CVE-2025-15458 | High | 7.3 | 2026-01-05 | A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handl… |
CVE-2025-15457 | High | 7.3 | 2026-01-05 | A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Tras… |
CVE-2025-15456 | High | 7.3 | 2026-01-05 | A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Pu… |
CVE-2025-15455 | Medium | 6.5 | 2026-01-05 | A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery R… |
CVE-2025-67158 | High | 7.5 | 2026-01-02 | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and e… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-65925 | Medium | 6.5 | 2025-12-30 | An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the inte… |
CVE-2025-56333 | Critical | 9.8 | 2025-12-29 | An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component |
CVE-2025-15069 | High | 7.1 | 2025-12-29 | Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1 |
CVE-2025-15135 | Medium | 6.3 | 2025-12-28 | A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file Authenticat… |
CVE-2025-15099 | High | 7.3 | 2025-12-26 | A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the compon… |
CVE-2025-15097 | High | 7.3 | 2025-12-26 | A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation res… |
CVE-2023-52210 | Medium | 5.3 | 2025-12-23 | Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through… |
CVE-2025-66174 | Medium | 6.5 | 2025-12-19 | There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an… |
CVE-2025-14908 | Medium | 6.3 | 2025-12-19 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
CVE-2025-13427 | | 2025-12-18 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining a… | |
CVE-2025-14738 | High | 7.5 | 2025-12-18 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects… |
CVE-2025-67791 | Critical | 9.8 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in D… |
CVE-2025-44005 | Critical | 10.0 | 2025-12-17 | An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorizati… |
CVE-2025-14097 | High | 7.2 | 2025-12-17 | A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific in… |
CVE-2025-14002 | High | 8.1 | 2025-12-16 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak… |
CVE-2025-14746 | Medium | 4.3 | 2025-12-16 | A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such… |
CVE-2025-65781 | High | 8.2 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer… |
CVE-2025-65431 | Medium | 5.4 | 2025-12-15 | An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts… |
CVE-2025-37731 | Medium | 6.8 | 2025-12-15 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to ha… |
CVE-2025-14703 | Medium | 5.3 | 2025-12-15 | A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /fsnotify of the component POST Message… |
CVE-2025-14567 | Medium | 5.3 | 2025-12-12 | A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the fil… |
CVE-2025-10684 | Medium | 4.3 | 2025-12-12 | The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users… |
CVE-2025-67507 | High | 8.1 | 2025-12-10 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery… |
CVE-2025-66039 | Critical | 9.8 | 2025-12-09 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authenticat… |
CVE-2025-66515 | Low | 2.7 | 2025-12-05 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a w… |
CVE-2025-12374 | Critical | 9.8 | 2025-12-05 | The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to auth… |