CWE-287 · Improper Authentication (page 6)
Page 6 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6588 | Medium | 6.5 | 2026-04-20 | A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/rout… |
CVE-2026-6582 | High | 7.3 | 2026-04-19 | A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controller… |
CVE-2026-6579 | Medium | 6.5 | 2026-04-19 | A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endp… |
CVE-2026-6577 | High | 7.3 | 2026-04-19 | A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the comp… |
CVE-2026-6569 | High | 7.3 | 2026-04-19 | A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the compone… |
CVE-2025-46641 | Medium | 6.6 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerab… |
CVE-2025-46607 | Medium | 6.6 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerab… |
CVE-2026-32072 | Medium | 6.2 | 2026-04-14 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-23708 | High | 7.5 | 2026-04-14 | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through… |
CVE-2026-6129 | High | 7.3 | 2026-04-12 | A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performi… |
CVE-2026-6126 | High | 7.3 | 2026-04-12 | A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP E… |
CVE-2026-40178 | Medium | 5.9 | 2026-04-10 | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a shor… |
CVE-2026-40177 | High | 7.5 | 2026-04-10 | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the… |
CVE-2026-34727 | High | 7.4 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the… |
CVE-2026-4664 | Medium | 5.3 | 2026-04-10 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.103.0. This is due to… |
CVE-2026-40109 | Low | 3.1 | 2026-04-09 | Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Fl… |
CVE-2026-34500 | Medium | 6.5 | 2026-04-09 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache… |
CVE-2026-29145 | Critical | 9.1 | 2026-04-09 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This… |
CVE-2026-39976 | High | 7.1 | 2026-04-09 | Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the… |
CVE-2026-5959 | Medium | 6.6 | 2026-04-09 | A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the compo… |
CVE-2026-39411 | Medium | 5.0 | 2026-04-08 | LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer… |
CVE-2026-5795 | High | 7.4 | 2026-04-08 | In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial check… |
CVE-2026-39322 | High | 8.8 | 2026-04-07 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, POST /api/v1/auth/sign-in creates a valid session for banned accounts be… |
CVE-2026-39324 | Critical | 9.8 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c… |
CVE-2026-5676 | High | 7.3 | 2026-04-06 | A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such man… |
CVE-2026-35030 | Critical | 9.1 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: tru… |
CVE-2026-5632 | High | 7.3 | 2026-04-06 | A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a man… |
CVE-2026-5616 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jee… |
CVE-2026-5570 | High | 7.3 | 2026-04-05 | A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the file /LoginCB. This ma… |
CVE-2026-5557 | Medium | 6.3 | 2026-04-05 | A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the componen… |
CVE-2018-25236 | Critical | 9.8 | 2026-04-03 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) m… |
CVE-2017-20235 | Critical | 9.1 | 2026-04-03 | ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unaut… |
CVE-2026-34990 | High | 7.8 | 2026-04-03 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user ca… |
CVE-2026-33175 | High | 8.8 | 2026-04-03 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass v… |
CVE-2017-20237 | Critical | 9.8 | 2026-04-03 | Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthen… |
CVE-2026-32173 | High | 8.6 | 2026-04-03 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. |
CVE-2026-34834 | High | 7.5 | 2026-04-02 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned… |
CVE-2024-14034 | Critical | 9.8 | 2026-04-02 | Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated… |
CVE-2026-34736 | Medium | 5.3 | 2026-04-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated att… |
CVE-2026-34121 | High | 8.8 | 2026-04-02 | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent… |
CVE-2026-33746 | Critical | 9.8 | 2026-04-02 | Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify… |
CVE-2026-5320 | High | 7.3 | 2026-04-02 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the compon… |
CVE-2026-4101 | High | 8.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-34873 | Critical | 9.1 | 2026-04-01 | An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session. |
CVE-2026-34531 | Medium | 6.5 | 2026-04-01 | Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request t… |
CVE-2026-34072 | High | 8.3 | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentica… |
CVE-2026-4829 | Medium | 5.4 | 2026-04-01 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as o… |
CVE-2025-15484 | Critical | 9.1 | 2026-04-01 | The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated req… |
CVE-2025-71279 | Critical | 9.8 | 2026-04-01 | XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of… |
CVE-2026-34204 | High | 7.1 | 2026-03-31 | MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated… |
CVE-2026-31946 | Critical | 9.8 | 2026-03-30 | OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, Op… |
CVE-2026-0558 | Critical | 9.8 | 2026-03-29 | A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract… |
CVE-2026-5000 | High | 7.3 | 2026-03-28 | A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file bac… |
CVE-2026-34389 | Medium | 6.5 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during… |
CVE-2026-4959 | High | 7.3 | 2026-03-27 | A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the compone… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-33898 | High | 8.8 | 2026-03-27 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authenticat… |
CVE-2026-4831 | Low | 3.7 | 2026-03-26 | A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.clas… |
CVE-2026-33248 | Medium | 4.2 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for clien… |
CVE-2026-33246 | Medium | 6.4 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, p… |
CVE-2026-33665 | High | 7.5 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.4.0 and 1.121.0, when LDAP authentication is enabled, n8n automatically linked an LDAP… |
CVE-2026-33215 | Medium | 6.5 | 2026-03-24 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to ver… |
CVE-2026-33322 | Critical | 9.8 | 2026-03-24 | MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-16Z, a JWT algorithm confusion vulnerab… |
CVE-2026-33314 | Medium | 6.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check d… |
CVE-2026-33409 | Critical | 9.1 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authent… |
CVE-2026-33473 | Medium | 5.7 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have the… |
CVE-2026-4021 | High | 8.1 | 2026-03-24 | The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1… |
CVE-2026-32879 | Medium | 4.9 | 2026-03-23 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the univer… |
CVE-2026-33716 | Critical | 9.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-4592 | Medium | 5.6 | 2026-03-23 | A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/… |
CVE-2026-4587 | Low | 3.7 | 2026-03-23 | A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handl… |
CVE-2026-4583 | Medium | 5.0 | 2026-03-23 | A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth H… |
CVE-2026-4582 | Medium | 5.0 | 2026-03-23 | A security vulnerability has been detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2026-4562 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component… |
CVE-2026-2756 | Medium | 5.0 | 2026-03-21 | A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipula… |
CVE-2026-32305 | Medium | 5.3 | 2026-03-20 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass throug… |
CVE-2026-33124 | High | 8.8 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to c… |
CVE-2026-4476 | Medium | 6.3 | 2026-03-20 | A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the c… |
CVE-2026-32815 | High | 7.5 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific UR… |
CVE-2026-30836 | Critical | 10.0 | 2026-03-19 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unau… |
CVE-2025-14716 | Medium | 6.5 | 2026-03-19 | Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0. |
CVE-2026-32730 | High | 8.1 | 2026-03-18 | ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/in… |
CVE-2026-33042 | Medium | 5.3 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up… |
CVE-2026-2991 | High | 7.3 | 2026-03-18 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2… |
CVE-2026-25937 | Medium | 6.5 | 2026-03-18 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's c… |
CVE-2026-4349 | Medium | 5.6 | 2026-03-17 | A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the compone… |
CVE-2026-4252 | Critical | 9.8 | 2026-03-16 | A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation l… |
CVE-2026-4187 | Medium | 5.3 | 2026-03-16 | A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInf… |
CVE-2026-21004 | Medium | 6.5 | 2026-03-16 | Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service. |
CVE-2026-32246 | High | 8.5 | 2026-03-12 | Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password veri… |
CVE-2026-32136 | Critical | 9.8 | 2026-03-11 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in A… |
CVE-2026-1524 | Critical | 9.8 | 2026-03-11 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions… |
CVE-2026-23813 | Critical | 9.8 | 2026-03-11 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to ci… |
CVE-2026-30967 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authenti… |
CVE-2026-30949 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authent… |
CVE-2026-29792 | Critical | 9.8 | 2026-03-10 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attac… |
CVE-2026-26141 | High | 7.8 | 2026-03-10 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2026-26128 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-24294 | High | 7.8 | 2026-03-10 | Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. |