CVE-2026-100261 | Medium | 5.4 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
CVE-2026-88828 | Medium | 5.4 | 2026-09-28 | The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder… |
CVE-2026-63493 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the perso… |
CVE-2026-90481 | | | 2026-09-24 | In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel. |
CVE-2026-79680 | | | 2026-09-24 | Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client tha… |
CVE-2026-93928 | High | 7.3 | 2026-09-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.
T… |
CVE-2026-58269 | High | 8.1 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates w… |
CVE-2026-81868 | Medium | 6.5 | 2026-09-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security… |
CVE-2026-62101 | Critical | 9.8 | 2026-09-17 | Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
CVE-2026-14917 | | | 2026-09-16 | A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is… |
CVE-2026-27546 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly con… |
CVE-2026-57134 | High | 8.2 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured cr… |
CVE-2026-91143 | High | 7.2 | 2026-09-14 | goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requireme… |
CVE-2026-88260 | | | 2026-09-11 | Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8… |
CVE-2026-81906 | | | 2026-09-11 | Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A d… |
CVE-2026-81796 | High | 7.3 | 2026-09-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue af… |
CVE-2026-81787 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. |
CVE-2026-81783 | High | 7.1 | 2026-09-10 | Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. |
CVE-2026-88861 | High | 8.3 | 2026-09-10 | Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization… |
CVE-2026-86084 | Medium | 5.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authenticatio… |
CVE-2026-49887 | High | 7.8 | 2026-09-08 | In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to… |
CVE-2026-83527 | High | 8.1 | 2026-09-08 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level acce… |
CVE-2026-77103 | High | 7.5 | 2026-09-08 | CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenanc… |
CVE-2026-62650 | High | 8.8 | 2026-09-08 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not pro… |
CVE-2026-76169 | High | 7.5 | 2026-09-04 | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugi… |
CVE-2026-62916 | Critical | 9.1 | 2026-09-03 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-84777 | High | 7.4 | 2026-09-03 | Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. |
CVE-2026-81168 | Low | 3.7 | 2026-09-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA… |
CVE-2026-16647 | Medium | 4.1 | 2026-09-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Log… |
CVE-2026-82225 | High | 7.4 | 2026-08-31 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. |
CVE-2026-82269 | High | 8.1 | 2026-08-28 | Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys ca… |
CVE-2026-76943 | Critical | 9.8 | 2026-08-28 | Xiiaozet LK100Wt contains an authentication weakness within an
administrative service that may allow an attacker to bypass intended
access controls and obtai… |
CVE-2026-65641 | | | 2026-08-26 | A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. |
CVE-2026-3035 | Medium | 5.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-58092 | High | 8.1 | 2026-08-26 | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array… |
CVE-2026-16639 | Critical | 9.8 | 2026-08-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue a… |
CVE-2026-63587 | High | 8.6 | 2026-08-25 | The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increme… |
CVE-2026-78259 | High | 7.3 | 2026-08-24 | Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions. |
CVE-2026-74001 | Critical | 9.8 | 2026-08-20 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. |
CVE-2026-66677 | High | 7.6 | 2026-08-20 | Subscriber Broken Authentication in Leyka <= 3.32.3 versions. |
CVE-2026-19490 | Critical | 9.8 | 2026-08-19 | Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through… |
CVE-2026-50191 | High | 8.8 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRe… |
CVE-2026-24185 | High | 7.1 | 2026-08-18 | NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an adm… |
CVE-2021-43718 | Medium | 5.3 | 2026-08-18 | An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via… |
CVE-2026-71879 | | | 2026-08-18 | Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote… |
CVE-2026-73399 | Medium | 6.5 | 2026-08-18 | Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. |
CVE-2026-73398 | Medium | 6.5 | 2026-08-18 | Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions. |
CVE-2026-73396 | High | 7.1 | 2026-08-18 | Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. |
CVE-2026-73381 | Critical | 9.1 | 2026-08-18 | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. |
CVE-2026-73379 | Medium | 6.5 | 2026-08-18 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. |
CVE-2026-32481 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions. |
CVE-2026-75627 | Critical | 9.8 | 2026-08-18 | Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by pr… |
CVE-2026-75045 | Critical | 9.1 | 2026-08-17 | In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature |
CVE-2026-66465 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. |
CVE-2026-66453 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
CVE-2026-70468 | High | 8.1 | 2026-08-12 | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 t… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-72691 | High | 7.5 | 2026-08-10 | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file a… |
CVE-2026-66451 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. |
CVE-2026-66425 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions. |
CVE-2026-65542 | High | 8.8 | 2026-08-06 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. |
CVE-2026-24254 | Critical | 9.8 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit… |
CVE-2026-58073 | | | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. |
CVE-2026-68584 | High | 8.6 | 2026-08-03 | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadin… |
CVE-2026-18574 | | | 2026-08-03 | An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticat… |
CVE-2026-33591 | | | 2026-08-03 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass
security restriction using a specially crafted pa… |
CVE-2026-18577 | High | 8.1 | 2026-08-02 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
CVE-2026-18556 | High | 7.4 | 2026-08-01 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through… |
CVE-2026-67337 | Medium | 6.5 | 2026-08-01 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary cr… |
CVE-2026-8338 | | | 2026-07-29 | A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threa… |
CVE-2026-12703 | High | 8.0 | 2026-07-29 | TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2… |
CVE-2026-18047 | Medium | 6.5 | 2026-07-28 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints… |
CVE-2026-15014 | Critical | 9.8 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to… |
CVE-2026-59545 | High | 8.1 | 2026-07-23 | Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. |
CVE-2026-59524 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. |
CVE-2026-22049 | High | 8.8 | 2026-07-22 | ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID… |
CVE-2026-43945 | | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full… |
CVE-2026-61425 | | | 2026-07-20 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially lea… |
CVE-2026-39385 | | | 2026-07-20 | Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated b… |
CVE-2026-16198 | Medium | 5.6 | 2026-07-19 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go o… |
CVE-2026-57980 | Medium | 5.4 | 2026-07-17 | Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-47481 | Medium | 6.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel… |
CVE-2026-57698 | Medium | 6.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows… |
CVE-2026-57697 | High | 7.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Passwo… |
CVE-2026-57807 | Critical | 9.8 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allow… |
CVE-2026-36028 | Medium | 6.8 | 2026-07-08 | A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset |
CVE-2026-57867 | | | 2026-07-07 | MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate de… |
CVE-2026-5268 | Critical | 9.1 | 2026-07-06 | An authentication bypass vulnerability exists in
the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remot… |
CVE-2025-13475 | Low | 3.5 | 2026-07-04 | In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a use… |
CVE-2026-58517 | Medium | 4.3 | 2026-07-01 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.
This iss… |
CVE-2026-12579 | High | 7.4 | 2026-07-01 | AS228T with Authentication Bypass Vulnerability |
CVE-2026-20460 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected… |
CVE-2026-20459 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2026-58172 | Critical | 9.1 | 2026-06-30 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restr… |
CVE-2026-53576 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) t… |
CVE-2026-56029 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. |
CVE-2026-55666 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/mete… |
CVE-2026-33543 | | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intende… |
CVE-2026-53622 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS c… |
CVE-2026-48491 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNI… |