CWE-287 · Improper Authentication (page 3)
Page 3 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86890 | Medium | 4.6 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a… |
CVE-2026-84623 | High | 7.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able… |
CVE-2026-84606 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may… |
CVE-2026-65375 | High | 7.5 | 2026-09-14 | The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An app may be able to… |
CVE-2026-43674 | Medium | 4.6 | 2026-09-14 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unloc… |
CVE-2026-20683 | High | 7.1 | 2026-09-14 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, ma… |
CVE-2026-19273 | Medium | 5.4 | 2026-09-14 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 -… |
CVE-2026-17628 | Medium | 5.4 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication. |
CVE-2026-54176 | Medium | 6.5 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-57132 | High | 8.2 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/inv… |
CVE-2026-55235 | Medium | 5.9 | 2026-09-14 | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhoo… |
CVE-2026-90961 | | 2026-09-14 | The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace… | |
CVE-2026-90623 | Low | 3.7 | 2026-09-14 | A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh_connection.py of the… |
CVE-2026-90620 | High | 7.3 | 2026-09-14 | A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file he… |
CVE-2026-90601 | High | 7.3 | 2026-09-13 | A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API… |
CVE-2026-90579 | High | 7.3 | 2026-09-13 | A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custo… |
CVE-2026-90524 | High | 7.3 | 2026-09-13 | A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unkn… |
CVE-2026-90513 | Medium | 6.5 | 2026-09-13 | A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of t… |
CVE-2026-90504 | High | 7.3 | 2026-09-13 | A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The… |
CVE-2026-89080 | High | 7.5 | 2026-09-13 | The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor en… |
CVE-2026-90474 | Medium | 6.8 | 2026-09-12 | MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by… |
CVE-2026-75800 | Critical | 9.8 | 2026-09-12 | The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, al… |
CVE-2026-79395 | Critical | 9.8 | 2026-09-11 | An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 f… |
CVE-2026-54047 | | 2026-09-11 | Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication… | |
CVE-2026-71416 | High | 8.8 | 2026-09-11 | Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin`… |
CVE-2026-86781 | Medium | 5.3 | 2026-09-11 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file down… |
CVE-2026-14563 | Critical | 9.8 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email addres… |
CVE-2026-14559 | Critical | 9.8 | 2026-09-11 | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers… |
CVE-2026-82107 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to… |
CVE-2026-88018 | Critical | 9.8 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with… |
CVE-2026-88007 | Critical | 9.1 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.A… |
CVE-2026-88895 | High | 7.2 | 2026-09-10 | CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived toke… |
CVE-2026-77771 | High | 7.5 | 2026-09-10 | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account b… |
CVE-2026-87924 | Medium | 6.5 | 2026-09-09 | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part… |
CVE-2026-87922 | High | 7.3 | 2026-09-09 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is t… |
CVE-2026-87016 | High | 8.1 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_exte… |
CVE-2026-47156 | | 2026-09-09 | MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any… | |
CVE-2026-87806 | High | 7.4 | 2026-09-09 | Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forward… |
CVE-2026-80099 | High | 8.8 | 2026-09-09 | Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module… |
CVE-2026-79974 | Medium | 6.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerabilit… |
CVE-2026-76009 | High | 8.1 | 2026-09-09 | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `N… |
CVE-2026-86810 | High | 7.3 | 2026-09-08 | A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Contro… |
CVE-2026-86808 | High | 7.3 | 2026-09-08 | A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_han… |
CVE-2026-78560 | Medium | 4.8 | 2026-09-08 | The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptogra… |
CVE-2026-28606 | Critical | 9.8 | 2026-09-08 | In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalatio… |
CVE-2026-86669 | High | 7.3 | 2026-09-08 | A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a mani… |
CVE-2026-80097 | High | 8.6 | 2026-09-08 | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-69854 | Critical | 9.0 | 2026-09-08 | Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-86723 | High | 8.1 | 2026-09-08 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comp… |
CVE-2026-86722 | High | 8.1 | 2026-09-08 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that write… |
CVE-2026-86721 | High | 7.5 | 2026-09-08 | AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['… |
CVE-2026-79576 | Critical | 9.8 | 2026-09-08 | An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a pa… |
CVE-2026-82758 | | 2026-09-07 | Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dy… | |
CVE-2026-18922 | Critical | 9.8 | 2026-09-07 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bin… |
CVE-2026-80128 | Medium | 6.4 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerabilit… |
CVE-2026-86426 | Critical | 9.8 | 2026-09-07 | LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by s… |
CVE-2026-86306 | High | 7.3 | 2026-09-07 | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part… |
CVE-2026-86300 | High | 7.3 | 2026-09-07 | A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes impro… |
CVE-2026-86293 | Medium | 6.5 | 2026-09-07 | A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.p… |
CVE-2026-86292 | High | 7.3 | 2026-09-07 | A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component Use… |
CVE-2026-86214 | High | 7.3 | 2026-09-06 | A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the… |
CVE-2026-75816 | Critical | 9.8 | 2026-09-06 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12… |
CVE-2026-18056 | High | 7.5 | 2026-09-06 | The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1… |
CVE-2026-86117 | High | 8.1 | 2026-09-05 | Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on em… |
CVE-2026-77826 | High | 8.8 | 2026-09-05 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of… |
CVE-2026-13447 | Critical | 9.8 | 2026-09-05 | The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryp… |
CVE-2026-85702 | High | 7.3 | 2026-09-04 | A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation… |
CVE-2026-85701 | Medium | 5.3 | 2026-09-04 | A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.cre… |
CVE-2026-85637 | Medium | 5.3 | 2026-09-04 | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Ad… |
CVE-2026-85636 | Medium | 5.3 | 2026-09-04 | A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Log… |
CVE-2026-53761 | | 2026-09-04 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitat… | |
CVE-2026-18221 | High | 8.1 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters. |
CVE-2026-16892 | Medium | 5.4 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name mat… |
CVE-2026-75429 | Critical | 9.8 | 2026-09-04 | PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transpo… |
CVE-2026-85596 | Critical | 9.8 | 2026-09-04 | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress ca… |
CVE-2026-85595 | Critical | 9.8 | 2026-09-04 | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown… |
CVE-2026-83961 | High | 7.1 | 2026-09-03 | ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to… |
CVE-2026-84831 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker… | |
CVE-2026-84840 | Medium | 6.5 | 2026-09-02 | A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstra… |
CVE-2026-84839 | Medium | 5.3 | 2026-09-02 | A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component… |
CVE-2024-7956 | | 2026-09-02 | A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor mu… | |
CVE-2026-82183 | High | 8.1 | 2026-09-02 | The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthentica… |
CVE-2026-12526 | High | 8.1 | 2026-09-02 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the… |
CVE-2026-84423 | High | 7.3 | 2026-09-01 | A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource AP… |
CVE-2026-73777 | High | 8.1 | 2026-09-01 | Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing… |
CVE-2026-73771 | High | 7.5 | 2026-09-01 | An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote… |
CVE-2026-73764 | High | 7.1 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-76658 | Critical | 10.0 | 2026-09-01 | A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrat… |
CVE-2026-76657 | Critical | 10.0 | 2026-09-01 | Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent… |
CVE-2026-73733 | Medium | 5.4 | 2026-09-01 | Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentica… |
CVE-2026-73726 | Medium | 6.8 | 2026-09-01 | A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjace… |
CVE-2026-19766 | Critical | 9.6 | 2026-09-01 | An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unau… |
CVE-2026-84114 | Medium | 6.3 | 2026-09-01 | A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentic… |
CVE-2026-77194 | Medium | 5.3 | 2026-09-01 | The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4… |
CVE-2026-19806 | High | 8.8 | 2026-09-01 | The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leadin… |
CVE-2026-82919 | High | 7.3 | 2026-08-31 | A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit… |
CVE-2026-82906 | Low | 3.7 | 2026-08-31 | A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of… |
CVE-2026-61641 | High | 8.1 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC i… |
CVE-2026-54600 | | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is… | |
CVE-2026-82695 | Critical | 10.0 | 2026-08-31 | A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The… |