CWE-287 · Improper Authentication (page 8)
Page 8 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0589 | High | 7.3 | 2026-01-05 | A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The… |
CVE-2025-15458 | High | 7.3 | 2026-01-05 | A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handl… |
CVE-2025-15457 | High | 7.3 | 2026-01-05 | A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Tras… |
CVE-2025-15456 | High | 7.3 | 2026-01-05 | A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Pu… |
CVE-2025-15455 | Medium | 6.5 | 2026-01-05 | A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery R… |
CVE-2025-67158 | High | 7.5 | 2026-01-02 | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and e… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-65925 | Medium | 6.5 | 2025-12-30 | An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the inte… |
CVE-2025-56333 | Critical | 9.8 | 2025-12-29 | An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component |
CVE-2025-15069 | High | 7.1 | 2025-12-29 | Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1 |
CVE-2025-15135 | Medium | 6.3 | 2025-12-28 | A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file Authenticat… |
CVE-2025-15099 | High | 7.3 | 2025-12-26 | A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the compon… |
CVE-2025-15097 | High | 7.3 | 2025-12-26 | A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation res… |
CVE-2023-52210 | Medium | 5.3 | 2025-12-23 | Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through… |
CVE-2025-66174 | Medium | 6.5 | 2025-12-19 | There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an… |
CVE-2025-14908 | Medium | 6.3 | 2025-12-19 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
CVE-2025-13427 | | 2025-12-18 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining a… | |
CVE-2025-14738 | High | 7.5 | 2025-12-18 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects… |
CVE-2025-67791 | Critical | 9.8 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in D… |
CVE-2025-44005 | Critical | 10.0 | 2025-12-17 | An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorizati… |
CVE-2025-14097 | High | 7.2 | 2025-12-17 | A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific in… |
CVE-2025-14002 | High | 8.1 | 2025-12-16 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak… |
CVE-2025-14746 | Medium | 4.3 | 2025-12-16 | A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such… |
CVE-2025-65781 | High | 8.2 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer… |
CVE-2025-65431 | Medium | 5.4 | 2025-12-15 | An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts… |
CVE-2025-37731 | Medium | 6.8 | 2025-12-15 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to ha… |
CVE-2025-14703 | Medium | 5.3 | 2025-12-15 | A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /fsnotify of the component POST Message… |
CVE-2025-14567 | Medium | 5.3 | 2025-12-12 | A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the fil… |
CVE-2025-10684 | Medium | 4.3 | 2025-12-12 | The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users… |
CVE-2025-67507 | High | 8.1 | 2025-12-10 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery… |
CVE-2025-66039 | Critical | 9.8 | 2025-12-09 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authenticat… |
CVE-2025-66515 | Low | 2.7 | 2025-12-05 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a w… |
CVE-2025-12374 | Critical | 9.8 | 2025-12-05 | The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to auth… |
CVE-2025-64055 | Critical | 9.8 | 2025-12-03 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g… |
CVE-2025-59704 | Medium | 4.6 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no passwor… |
CVE-2025-66022 | Critical | 9.6 | 2025-11-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework per… |
CVE-2025-9803 | High | 8.8 | 2025-11-25 | lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to v… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-63207 | Critical | 9.8 | 2025-11-19 | The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on t… |
CVE-2025-63224 | Critical | 10.0 | 2025-11-19 | The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JW… |
CVE-2025-63216 | Critical | 10.0 | 2025-11-18 | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid J… |
CVE-2024-21635 | High | 7.5 | 2025-11-14 | Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the e… |
CVE-2025-64717 | Critical | 9.8 | 2025-11-13 | ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL'… |
CVE-2025-64517 | Medium | 4.4 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target ac… |
CVE-2025-12998 | | 2025-11-12 | Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5… | |
CVE-2025-64513 | | 2025-11-10 | Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4… | |
CVE-2025-64434 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCer… |
CVE-2025-64432 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggrega… |
CVE-2025-3222 | | 2025-11-07 | Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior ver… | |
CVE-2025-20730 | Medium | 6.7 | 2025-11-04 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious act… |
CVE-2025-64103 | Critical | 9.8 | 2025-10-29 | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMF… |
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2025-43995 | Critical | 9.8 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote ac… |
CVE-2025-6979 | High | 8.8 | 2025-10-23 | Captive Portal can allow authentication bypass |
CVE-2025-62169 | High | 8.1 | 2025-10-23 | OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and… |
CVE-2025-62398 | Medium | 5.4 | 2025-10-23 | A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising… |
CVE-2025-56447 | Critical | 9.8 | 2025-10-22 | TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. |
CVE-2025-41110 | High | 8.8 | 2025-10-22 | Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi… |
CVE-2025-41108 | Critical | 9.8 | 2025-10-22 | The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack statio… |
CVE-2025-60772 | Critical | 9.8 | 2025-10-21 | Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges… |
CVE-2025-11625 | Critical | 9.8 | 2025-10-21 | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. |
CVE-2025-11942 | High | 7.3 | 2025-10-19 | A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authen… |
CVE-2025-11852 | Medium | 5.3 | 2025-10-16 | A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF S… |
CVE-2025-61922 | Critical | 9.1 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, miss… |
CVE-2025-43281 | High | 7.8 | 2025-10-15 | The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate their privileges. |
CVE-2025-10293 | High | 8.8 | 2025-10-15 | The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu… |
CVE-2025-62376 | | 2025-10-14 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contain… | |
CVE-2025-59280 | Low | 3.1 | 2025-10-14 | Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network. |
CVE-2025-55340 | High | 7.0 | 2025-10-14 | Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally. |
CVE-2025-53845 | Medium | 6.5 | 2025-10-14 | An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to… |
CVE-2025-9064 | Critical | 9.1 | 2025-10-14 | A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete… |
CVE-2025-9063 | Critical | 9.8 | 2025-10-14 | An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-11661 | High | 7.3 | 2025-10-13 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Perform… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-11529 | High | 7.3 | 2025-10-09 | A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddlewar… |
CVE-2025-11192 | High | 8.6 | 2025-10-07 | A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure… |
CVE-2025-11287 | High | 7.3 | 2025-10-05 | A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2025-61679 | High | 7.7 | 2025-10-03 | Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low pri… |
CVE-2025-54154 | Medium | 6.8 | 2025-10-03 | An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulner… |
CVE-2025-61665 | High | 7.5 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identifie… |
CVE-2025-41064 | | 2025-10-02 | Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as an authentication method. | |
CVE-2025-11130 | High | 8.4 | 2025-09-29 | A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTo… |
CVE-2025-59934 | Critical | 9.4 | 2025-09-26 | Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a t… |
CVE-2025-20160 | High | 8.1 | 2025-09-24 | A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker t… |
CVE-2025-10906 | High | 8.4 | 2025-09-24 | A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endura… |
CVE-2025-0672 | Low | 3.3 | 2025-09-23 | An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does no… |
CVE-2025-0663 | Medium | 6.8 | 2025-09-23 | A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptogr… |
CVE-2025-9965 | | 2025-09-23 | Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue… | |
CVE-2025-57434 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username… |
CVE-2025-10772 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_… |
CVE-2025-54761 | High | 8.0 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
CVE-2025-10672 | High | 7.8 | 2025-09-18 | A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swif… |
CVE-2025-34186 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for au… |
CVE-2025-31271 | High | 7.5 | 2025-09-15 | This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26. Incoming FaceTime calls can appear or be accepted on a locke… |
CVE-2025-10423 | Low | 3.7 | 2025-09-15 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable capt… |