CWE-287 · Improper Authentication (page 2)
Page 2 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14836 | High | 8.1 | 2026-08-01 | The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both th… |
CVE-2026-14596 | High | 8.8 | 2026-08-01 | The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it ema… |
CVE-2026-14561 | Medium | 6.5 | 2026-08-01 | The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid ve… |
CVE-2026-14309 | High | 8.1 | 2026-08-01 | The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-… |
CVE-2026-14214 | Low | 2.7 | 2026-08-01 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allo… |
CVE-2026-18215 | Medium | 6.8 | 2026-07-31 | Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where… |
CVE-2026-14919 | Critical | 9.8 | 2026-07-31 | The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is sat… |
CVE-2026-14830 | High | 7.5 | 2026-07-31 | The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated ord… |
CVE-2026-12695 | High | 8.1 | 2026-07-31 | The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifyin… |
CVE-2026-14541 | High | 7.5 | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google… |
CVE-2026-28323 | Critical | 9.8 | 2026-07-30 | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled. |
CVE-2026-58066 | Critical | 9.8 | 2026-07-30 | Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validat… |
CVE-2026-56850 | Medium | 4.1 | 2026-07-30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requ… |
CVE-2026-15240 | High | 7.5 | 2026-07-30 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower… |
CVE-2026-14305 | Medium | 5.3 | 2026-07-30 | The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify l… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supply… |
CVE-2026-14300 | High | 8.1 | 2026-07-29 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optiona… |
CVE-2026-13690 | High | 7.4 | 2026-07-29 | The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who al… |
CVE-2026-49447 | Medium | 5.3 | 2026-07-28 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cos… |
CVE-2026-54635 | High | 7.5 | 2026-07-28 | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher f… |
CVE-2026-64745 | Low | 2.4 | 2026-07-27 | This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical… |
CVE-2026-43766 | Medium | 4.6 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An att… |
CVE-2026-66014 | High | 8.8 | 2026-07-27 | JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalat… |
CVE-2026-9830 | High | 8.2 | 2026-07-27 | The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of it… |
CVE-2026-14568 | Medium | 6.5 | 2026-07-27 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not cor… |
CVE-2026-13597 | Critical | 9.1 | 2026-07-27 | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generat… |
CVE-2026-13332 | Critical | 9.1 | 2026-07-27 | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowin… |
CVE-2026-12493 | High | 7.5 | 2026-07-27 | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs t… |
CVE-2026-12255 | High | 8.1 | 2026-07-27 | The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication… |
CVE-2026-12504 | | 2026-07-24 | Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A6… | |
CVE-2026-12877 | Critical | 9.1 | 2026-07-24 | The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL… |
CVE-2026-62825 | Critical | 10.0 | 2026-07-24 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-56191 | Critical | 10.0 | 2026-07-24 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-15981 | Critical | 9.8 | 2026-07-23 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the… |
CVE-2026-10697 | High | 7.5 | 2026-07-23 | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-15611 | Critical | 9.1 | 2026-07-23 | Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unaut… |
CVE-2026-15348 | Medium | 6.3 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 v… |
CVE-2026-14291 | High | 7.5 | 2026-07-23 | The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, a… |
CVE-2026-60367 | Critical | 9.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-62144 | Critical | 9.1 | 2026-07-22 | An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to exe… |
CVE-2026-16232 | Critical | 9.8 | 2026-07-22 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login t… |
CVE-2026-62547 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12… |
CVE-2026-62534 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12… |
CVE-2026-62498 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-62496 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62493 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-1… |
CVE-2026-62478 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-62476 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62464 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-62447 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-61322 | High | 8.8 | 2026-07-21 | Vulnerability in the TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. E… |
CVE-2026-61320 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2… |
CVE-2026-61311 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-1… |
CVE-2026-61243 | High | 8.8 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Staffing). The supported version that is aff… |
CVE-2026-61233 | Critical | 9.8 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is aff… |
CVE-2026-61225 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affect… |
CVE-2026-61188 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version th… |
CVE-2026-61183 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported version that… |
CVE-2026-61180 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor… |
CVE-2026-61179 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor… |
CVE-2026-61178 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version th… |
CVE-2026-61168 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitab… |
CVE-2026-61163 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version… |
CVE-2026-61154 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is… |
CVE-2026-61149 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The suppo… |
CVE-2026-61137 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is… |
CVE-2026-61131 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is… |
CVE-2026-61129 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily e… |
CVE-2026-61127 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Solution Designer). Supported versions that… |
CVE-2026-61121 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.8-12.2.15. Eas… |
CVE-2026-61110 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-61099 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-61098 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-61074 | High | 8.1 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is af… |
CVE-2026-61067 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-61065 | Critical | 9.8 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-61049 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-61010 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff… |
CVE-2026-60989 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-60952 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60932 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-60931 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60927 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60924 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-60920 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-60908 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2… |
CVE-2026-60901 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-60898 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2026-60897 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60890 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60872 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected ar… |
CVE-2026-60863 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12… |
CVE-2026-60678 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60654 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60615 | High | 8.2 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is… |
CVE-2026-60599 | High | 8.1 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affe… |
CVE-2026-60598 | High | 7.5 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affe… |
CVE-2026-60583 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. E… |
CVE-2026-60579 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected… |
CVE-2026-60578 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected… |