CWE-287 · Improper Authentication (page 4)
Page 4 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82694 | Critical | 10.0 | 2026-08-31 | A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web… |
CVE-2026-82693 | Critical | 10.0 | 2026-08-31 | A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web… |
CVE-2026-49003 | Critical | 9.6 | 2026-08-31 | Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simul… |
CVE-2026-82547 | Medium | 6.5 | 2026-08-30 | A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Regis… |
CVE-2026-75807 | High | 7.5 | 2026-08-29 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_… |
CVE-2026-82466 | High | 8.7 | 2026-08-29 | Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other acco… |
CVE-2026-76548 | High | 8.2 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabil… |
CVE-2026-55678 | | 2026-08-28 | Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without auth… | |
CVE-2026-18891 | High | 8.2 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication. |
CVE-2026-17203 | High | 7.5 | 2026-08-28 | IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforc… |
CVE-2026-82329 | Critical | 9.8 | 2026-08-28 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain ad… |
CVE-2026-73208 | High | 7.4 | 2026-08-28 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the aud… |
CVE-2026-42008 | Medium | 4.3 | 2026-08-28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that ho… |
CVE-2026-40205 | Medium | 5.9 | 2026-08-28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configur… |
CVE-2026-37006 | Critical | 9.8 | 2026-08-27 | A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via maliciou… |
CVE-2026-81703 | Medium | 5.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with… |
CVE-2026-81202 | High | 7.3 | 2026-08-26 | A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component… |
CVE-2026-79938 | High | 7.6 | 2026-08-26 | Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could… |
CVE-2026-75325 | Critical | 9.8 | 2026-08-26 | DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters. |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-19718 | High | 8.1 | 2026-08-26 | The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin Wo… |
CVE-2026-14216 | Medium | 6.5 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queu… |
CVE-2026-80192 | High | 8.1 | 2026-08-26 | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When… |
CVE-2026-44476 | | 2026-08-25 | Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public… | |
CVE-2026-68569 | High | 8.1 | 2026-08-25 | Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if t… |
CVE-2026-79787 | Critical | 9.8 | 2026-08-25 | Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user ident… |
CVE-2026-24170 | High | 8.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by… |
CVE-2026-55533 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT a… |
CVE-2026-78885 | Medium | 5.6 | 2026-08-25 | A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService… |
CVE-2026-78863 | Medium | 6.3 | 2026-08-25 | A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre… |
CVE-2026-53561 | High | 7.4 | 2026-08-25 | An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on depl… |
CVE-2026-65633 | | 2026-08-25 | Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resour… | |
CVE-2026-78434 | Medium | 6.5 | 2026-08-24 | A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpde… |
CVE-2026-77567 | High | 8.1 | 2026-08-24 | Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-fi… |
CVE-2026-66908 | High | 7.5 | 2026-08-24 | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-… |
CVE-2026-78168 | Critical | 9.8 | 2026-08-24 | A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Va… |
CVE-2026-78167 | Critical | 10.0 | 2026-08-24 | A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validatio… |
CVE-2026-77002 | Critical | 9.8 | 2026-08-22 | The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing u… |
CVE-2026-77001 | Critical | 9.8 | 2026-08-22 | The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks… |
CVE-2026-77000 | Critical | 9.8 | 2026-08-22 | The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authentic… |
CVE-2026-76793 | High | 8.1 | 2026-08-22 | The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a… |
CVE-2026-18052 | High | 8.1 | 2026-08-22 | The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an alread… |
CVE-2025-15671 | Medium | 5.4 | 2026-08-21 | The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-… |
CVE-2026-46355 | High | 7.1 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/g… |
CVE-2026-17142 | Critical | 9.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication. |
CVE-2026-17000 | High | 8.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication. |
CVE-2026-16972 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication. |
CVE-2026-76338 | High | 8.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key coul… |
CVE-2026-16857 | High | 8.2 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication. |
CVE-2026-20317 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-62669 | High | 7.4 | 2026-08-19 | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only t… |
CVE-2026-16686 | High | 8.2 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication. |
CVE-2026-16656 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication. |
CVE-2026-19842 | High | 8.8 | 2026-08-19 | The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers a… |
CVE-2026-19709 | Medium | 5.3 | 2026-08-19 | The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against… |
CVE-2026-18031 | Critical | 9.8 | 2026-08-19 | The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the ref… |
CVE-2026-53958 | High | 7.6 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, sso… |
CVE-2026-50191 | High | 8.8 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRe… |
CVE-2026-21582 | | 2026-08-18 | This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center… | |
CVE-2026-15315 | High | 8.8 | 2026-08-18 | Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network… |
CVE-2026-70922 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications (component: Web UI). Supported ver… |
CVE-2026-70905 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12… |
CVE-2026-60679 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-52793 | High | 8.1 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAu… |
CVE-2026-44472 | High | 8.1 | 2026-08-18 | Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof… |
CVE-2026-73337 | High | 7.5 | 2026-08-18 | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass… |
CVE-2026-75774 | Low | 3.7 | 2026-08-18 | A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the co… |
CVE-2026-65329 | Medium | 5.9 | 2026-08-17 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, iOS 27 and iPadOS 27. An attacker in… |
CVE-2025-27621 | | 2026-08-17 | UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default us… | |
CVE-2026-74894 | Critical | 9.8 | 2026-08-17 | openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string wi… |
CVE-2026-19977 | Critical | 10.0 | 2026-08-17 | A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation… |
CVE-2026-19974 | Medium | 5.6 | 2026-08-17 | A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/… |
CVE-2026-19971 | Medium | 4.7 | 2026-08-17 | A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manip… |
CVE-2026-19714 | Critical | 9.1 | 2026-08-16 | The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to… |
CVE-2026-15384 | Medium | 5.7 | 2026-08-16 | The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops atta… |
CVE-2026-19924 | Critical | 9.8 | 2026-08-16 | A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the componen… |
CVE-2026-73054 | High | 7.5 | 2026-08-15 | SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters betwe… |
CVE-2026-18216 | Medium | 6.5 | 2026-08-15 | The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one sit… |
CVE-2026-15341 | Critical | 9.8 | 2026-08-15 | The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4… |
CVE-2026-15303 | Critical | 9.8 | 2026-08-15 | The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat… |
CVE-2026-74240 | Medium | 5.4 | 2026-08-14 | A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues relate… |
CVE-2026-17182 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validat… |
CVE-2026-17175 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. |
CVE-2026-16905 | Medium | 5.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication. |
CVE-2026-48528 | Critical | 9.8 | 2026-08-14 | Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated… |
CVE-2026-16739 | Medium | 5.9 | 2026-08-14 | The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the target… |
CVE-2026-73840 | Medium | 5.3 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in in… |
CVE-2026-73302 | | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email wi… | |
CVE-2026-19749 | Low | 3.7 | 2026-08-13 | A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability… |
CVE-2026-17101 | High | 8.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication. |
CVE-2026-17099 | High | 7.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication. |
CVE-2026-17075 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of au… |
CVE-2026-73655 | High | 7.4 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/goo… |
CVE-2026-16867 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authenticati… |
CVE-2026-17197 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity. |
CVE-2026-59500 | Critical | 10.0 | 2026-08-13 | : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator… |
CVE-2026-14182 | Critical | 9.8 | 2026-08-13 | The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a… |
CVE-2026-47718 | | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token req… | |
CVE-2026-73501 | Critical | 9.1 | 2026-08-12 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a… |
CVE-2024-27253 | Critical | 10.0 | 2026-08-12 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. |