CWE-287 · Improper Authentication (page 7)
Page 7 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0953 | Critical | 9.8 | 2026-03-10 | The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is d… |
CVE-2025-68402 | | 2026-03-09 | FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is curren… | |
CVE-2026-3794 | High | 7.3 | 2026-03-09 | A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API… |
CVE-2026-3739 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/s… |
CVE-2026-30863 | Critical | 9.8 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google… |
CVE-2026-30851 | High | 8.1 | 2026-03-07 | Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-… |
CVE-2026-29193 | High | 8.2 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login be… |
CVE-2026-30223 | High | 8.8 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJw… |
CVE-2026-30831 | Critical | 9.8 | 2026-03-06 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a… |
CVE-2026-28514 | Critical | 9.8 | 2026-03-06 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a… |
CVE-2026-28800 | Medium | 6.4 | 2026-03-06 | Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-priva… |
CVE-2026-28787 | High | 8.2 | 2026-03-06 | OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store th… |
CVE-2026-28428 | Medium | 5.3 | 2026-03-06 | Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic al… |
CVE-2026-29093 | High | 8.1 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0… |
CVE-2026-28471 | Medium | 5.3 | 2026-03-05 | OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be b… |
CVE-2026-3224 | Critical | 9.8 | 2026-03-03 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to… |
CVE-2026-24898 | Critical | 10.0 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vu… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-28408 | Critical | 9.8 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's ce… |
CVE-2026-27939 | High | 8.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users… |
CVE-2026-1305 | Medium | 5.3 | 2026-02-27 | The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed pe… |
CVE-2026-28215 | Critical | 9.1 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configur… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2026-26077 | Medium | 6.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, P… |
CVE-2026-27968 | Medium | 4.3 | 2026-02-26 | Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() ver… |
CVE-2026-3194 | Medium | 4.5 | 2026-02-25 | A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passph… |
CVE-2026-3192 | Medium | 5.6 | 2026-02-25 | A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the compon… |
CVE-2026-20129 | Critical | 9.8 | 2026-02-25 | A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected s… |
CVE-2026-20127 | Critical | 10.0 | 2026-02-25 | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vMana… |
CVE-2026-27611 | Medium | 6.5 | 2026-02-25 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, t… |
CVE-2026-24241 | Medium | 4.3 | 2026-02-24 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A suc… |
CVE-2026-3053 | High | 7.3 | 2026-02-24 | A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/confi… |
CVE-2026-27197 | Critical | 9.1 | 2026-02-21 | Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO imple… |
CVE-2026-27134 | High | 8.1 | 2026-02-21 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when… |
CVE-2025-70833 | Critical | 9.4 | 2026-02-20 | An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and f… |
CVE-2025-41023 | | 2026-02-19 | An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once in… | |
CVE-2025-15586 | | 2026-02-19 | OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentica… | |
CVE-2025-15581 | | 2026-02-18 | Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploit… | |
CVE-2025-7630 | Medium | 5.3 | 2026-02-18 | Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc… |
CVE-2026-1368 | High | 7.5 | 2026-02-18 | The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated… |
CVE-2026-26119 | High | 8.8 | 2026-02-17 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-25922 | High | 8.8 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signa… |
CVE-2026-25748 | High | 8.6 | 2026-02-12 | authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using fo… |
CVE-2026-20655 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker… |
CVE-2025-68663 | Medium | 5.3 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentication mechanism tha… |
CVE-2025-65128 | High | 8.1 | 2026-02-11 | A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers… |
CVE-2025-65127 | Medium | 6.5 | 2026-02-11 | A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access a… |
CVE-2026-2249 | Critical | 9.8 | 2026-02-11 | METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-2248 | Critical | 9.8 | 2026-02-11 | METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-21508 | High | 7.0 | 2026-02-10 | Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. |
CVE-2026-23906 | Critical | 9.8 | 2026-02-10 | Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic… |
CVE-2026-25893 | Critical | 9.8 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthentic… |
CVE-2025-10463 | High | 7.3 | 2026-02-09 | Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects… |
CVE-2026-2174 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulati… |
CVE-2026-2165 | High | 7.3 | 2026-02-08 | A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the… |
CVE-2026-25804 | Critical | 9.1 | 2026-02-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment sys… |
CVE-2026-2065 | Medium | 6.3 | 2026-02-06 | A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low… |
CVE-2025-64175 | High | 8.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-ac… |
CVE-2025-70841 | Critical | 10.0 | 2026-02-03 | Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2026-1740 | High | 7.3 | 2026-02-02 | A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidde… |
CVE-2025-62349 | Medium | 6.2 | 2026-01-30 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using… |
CVE-2025-6723 | | 2026-01-30 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere w… | |
CVE-2026-22764 | Medium | 4.3 | 2026-01-29 | Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker with remote access cou… |
CVE-2025-12810 | Medium | 6.5 | 2026-01-27 | Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 1… |
CVE-2026-24003 | Medium | 4.3 | 2026-01-26 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authent… |
CVE-2026-1410 | Medium | 6.4 | 2026-01-26 | A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation res… |
CVE-2026-0633 | Low | 3.7 | 2026-01-24 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2022-25369 | Critical | 9.8 | 2026-01-23 | An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2026-24038 | High | 8.1 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be byp… |
CVE-2026-1203 | Medium | 5.6 | 2026-01-20 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php… |
CVE-2026-1202 | High | 7.3 | 2026-01-20 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginControll… |
CVE-2026-0629 | | 2026-01-16 | Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the… | |
CVE-2025-67822 | Critical | 9.4 | 2026-01-15 | A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated atta… |
CVE-2025-65397 | Medium | 6.8 | 2026-01-14 | An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with phy… |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2026-22236 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2025-67859 | | 2026-01-14 | A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This iss… | |
CVE-2025-68931 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulner… |
CVE-2026-0408 | High | 8.0 | 2026-01-13 | A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents o… |
CVE-2026-0407 | High | 8.0 | 2026-01-13 | An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethern… |
CVE-2026-0405 | High | 7.8 | 2026-01-13 | An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin. |
CVE-2025-66698 | High | 8.6 | 2026-01-13 | An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints. |
CVE-2025-69273 | High | 7.5 | 2026-01-12 | Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3… |
CVE-2026-0842 | Medium | 6.3 | 2026-01-11 | A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulat… |
CVE-2026-22594 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows sta… |
CVE-2025-68717 | Critical | 9.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/sy… |
CVE-2026-21891 | Critical | 9.4 | 2026-01-08 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks th… |
CVE-2025-15224 | Low | 3.1 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a local… |
CVE-2026-21881 | Critical | 9.1 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE… |
CVE-2025-15346 | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… | |
CVE-2026-21854 | Critical | 9.8 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows… |
CVE-2025-14942 | Critical | 9.8 | 2026-01-06 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the cl… |
CVE-2025-60534 | Critical | 9.8 | 2026-01-06 | Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-64423 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2026-21633 | High | 8.8 | 2026-01-05 | A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerabili… |
CVE-2026-0589 | High | 7.3 | 2026-01-05 | A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The… |