CWE-287 · Improper Authentication (page 12)
Page 12 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64055 | Critical | 9.8 | 2025-12-03 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g… |
CVE-2025-59704 | Medium | 4.6 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an attacker to gain access… |
CVE-2025-66022 | Critical | 9.6 | 2025-11-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework per… |
CVE-2025-9803 | High | 8.8 | 2025-11-25 | lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to v… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-63207 | Critical | 9.8 | 2025-11-19 | The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on t… |
CVE-2025-63224 | Critical | 10.0 | 2025-11-19 | The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JW… |
CVE-2025-63216 | Critical | 10.0 | 2025-11-18 | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid J… |
CVE-2024-21635 | High | 7.5 | 2025-11-14 | Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the e… |
CVE-2025-64717 | Critical | 9.8 | 2025-11-13 | ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL'… |
CVE-2025-64517 | Medium | 4.4 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target ac… |
CVE-2025-12998 | | 2025-11-12 | Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5… | |
CVE-2025-64513 | | 2025-11-10 | Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4… | |
CVE-2025-64434 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCer… |
CVE-2025-64432 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggrega… |
CVE-2025-3222 | | 2025-11-07 | Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior ver… | |
CVE-2025-20730 | Medium | 6.7 | 2025-11-04 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious act… |
CVE-2025-64103 | Critical | 9.8 | 2025-10-29 | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMF… |
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2025-43995 | Critical | 9.8 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote ac… |
CVE-2025-6979 | High | 8.8 | 2025-10-23 | Captive Portal can allow authentication bypass |
CVE-2025-62169 | High | 8.1 | 2025-10-23 | OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and… |
CVE-2025-62398 | Medium | 5.4 | 2025-10-23 | A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising… |
CVE-2025-56447 | Critical | 9.8 | 2025-10-22 | TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. |
CVE-2025-41110 | High | 8.8 | 2025-10-22 | Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi… |
CVE-2025-41108 | Critical | 9.8 | 2025-10-22 | The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack statio… |
CVE-2025-60772 | Critical | 9.8 | 2025-10-21 | Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges… |
CVE-2025-11625 | Critical | 9.8 | 2025-10-21 | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. |
CVE-2025-11942 | High | 7.3 | 2025-10-19 | A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authen… |
CVE-2025-11852 | Medium | 5.3 | 2025-10-16 | A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF S… |
CVE-2025-61922 | Critical | 9.1 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, miss… |
CVE-2025-43281 | High | 7.8 | 2025-10-15 | The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate their privileges. |
CVE-2025-10293 | High | 8.8 | 2025-10-15 | The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu… |
CVE-2025-62376 | | 2025-10-14 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contain… | |
CVE-2025-59280 | Low | 3.1 | 2025-10-14 | Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network. |
CVE-2025-55340 | High | 7.0 | 2025-10-14 | Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally. |
CVE-2025-53845 | Medium | 6.5 | 2025-10-14 | An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to… |
CVE-2025-9064 | Critical | 9.1 | 2025-10-14 | A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete… |
CVE-2025-9063 | Critical | 9.8 | 2025-10-14 | An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-11661 | High | 7.3 | 2025-10-13 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Perform… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-11529 | High | 7.3 | 2025-10-09 | A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddlewar… |
CVE-2025-11192 | High | 8.6 | 2025-10-07 | A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure… |
CVE-2025-11287 | High | 7.3 | 2025-10-05 | A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2025-61679 | High | 7.7 | 2025-10-03 | Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low pri… |
CVE-2025-54154 | Medium | 6.8 | 2025-10-03 | An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulner… |
CVE-2025-61665 | High | 7.5 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identifie… |
CVE-2025-41064 | | 2025-10-02 | Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as an authentication method. | |
CVE-2025-11130 | High | 8.4 | 2025-09-29 | A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTo… |
CVE-2025-59934 | Critical | 9.4 | 2025-09-26 | Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a t… |
CVE-2025-20160 | High | 8.1 | 2025-09-24 | A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker t… |
CVE-2025-10906 | High | 8.4 | 2025-09-24 | A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endura… |
CVE-2025-0672 | Low | 3.3 | 2025-09-23 | An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does no… |
CVE-2025-0663 | Medium | 6.8 | 2025-09-23 | A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptogr… |
CVE-2025-9965 | | 2025-09-23 | Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue… | |
CVE-2025-57434 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username… |
CVE-2025-10772 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_… |
CVE-2025-54761 | High | 8.0 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
CVE-2025-10672 | High | 7.8 | 2025-09-18 | A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swif… |
CVE-2025-34186 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for au… |
CVE-2025-31271 | High | 7.5 | 2025-09-15 | This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26. Incoming FaceTime calls can appear or be accepted on a locke… |
CVE-2025-10423 | Low | 3.7 | 2025-09-15 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable capt… |
CVE-2025-45583 | Critical | 9.1 | 2025-09-12 | Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combina… |
CVE-2025-10365 | | 2025-09-12 | The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. Thi… | |
CVE-2025-10288 | Medium | 5.3 | 2025-09-12 | A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The impacted element is an unknown function of the file /user/in… |
CVE-2025-58065 | Medium | 6.5 | 2025-09-11 | Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database… |
CVE-2025-58060 | High | 8.0 | 2025-09-11 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set… |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-56578 | Medium | 5.7 | 2025-09-10 | An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms |
CVE-2025-10224 | Medium | 5.4 | 2025-09-10 | Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated… |
CVE-2025-57278 | High | 8.8 | 2025-09-09 | The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user aut… |
CVE-2025-55234 | High | 8.8 | 2025-09-09 | SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform rel… |
CVE-2025-54918 | High | 8.8 | 2025-09-09 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-9994 | Critical | 9.8 | 2025-09-09 | The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with netw… |
CVE-2025-58443 | Critical | 9.1 | 2025-09-06 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerabili… |
CVE-2025-55241 | Critical | 10.0 | 2025-09-04 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-26438 | High | 8.8 | 2025-09-04 | In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. Th… |
CVE-2025-56752 | Critical | 9.4 | 2025-09-03 | A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them w… |
CVE-2023-21471 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission. |
CVE-2023-21467 | Medium | 4.6 | 2025-09-03 | Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21466 | Medium | 5.3 | 2025-09-03 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withou… |
CVE-2024-40653 | High | 7.3 | 2025-09-02 | In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the co… |
CVE-2025-9815 | High | 7.8 | 2025-09-02 | A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHel… |
CVE-2025-52856 | Critical | 9.8 | 2025-08-29 | An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the s… |
CVE-2025-52054 | Medium | 5.3 | 2025-08-28 | An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated… |
CVE-2025-7955 | Critical | 9.8 | 2025-08-28 | The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_ve… |
CVE-2025-9533 | High | 7.3 | 2025-08-27 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the… |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2024-50645 | Critical | 9.8 | 2025-08-22 | MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-50644 | Critical | 9.8 | 2025-08-22 | zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-50641 | High | 8.1 | 2025-08-21 | An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token. |
CVE-2025-52395 | Critical | 9.8 | 2025-08-21 | An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to valida… |
CVE-2025-50901 | Critical | 9.8 | 2025-08-20 | JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. |
CVE-2024-50640 | Critical | 9.8 | 2025-08-20 | jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function |
CVE-2024-57491 | High | 8.8 | 2025-08-20 | Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token vi… |