CVE-2026-66465 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. |
CVE-2026-66453 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
CVE-2026-70468 | High | 8.1 | 2026-08-12 | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 t… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-72691 | High | 7.5 | 2026-08-10 | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file a… |
CVE-2026-66451 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. |
CVE-2026-66425 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions. |
CVE-2026-65542 | High | 8.8 | 2026-08-06 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. |
CVE-2026-24254 | Critical | 9.8 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit… |
CVE-2026-58073 | | | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. |
CVE-2026-68584 | High | 8.6 | 2026-08-03 | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadin… |
CVE-2026-18574 | | | 2026-08-03 | An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticat… |
CVE-2026-33591 | | | 2026-08-03 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass
security restriction using a specially crafted pa… |
CVE-2026-18577 | High | 8.1 | 2026-08-02 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
CVE-2026-18556 | High | 7.4 | 2026-08-01 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through… |
CVE-2026-67337 | Medium | 6.5 | 2026-08-01 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary cr… |
CVE-2026-8338 | | | 2026-07-29 | A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threa… |
CVE-2026-12703 | High | 8.0 | 2026-07-29 | TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2… |
CVE-2026-18047 | Medium | 6.5 | 2026-07-28 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints… |
CVE-2026-15014 | Critical | 9.8 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to… |
CVE-2026-61884 | Critical | 9.8 | 2026-07-24 | The web management interface of Tycon Systems TPDIN-Monitor-WEB2
does not perform server-side validation of credentials during the login process. By submitti… |
CVE-2026-59545 | High | 8.1 | 2026-07-23 | Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. |
CVE-2026-59524 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. |
CVE-2026-22049 | | | 2026-07-22 | ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID… |
CVE-2026-43945 | | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full… |
CVE-2026-61425 | | | 2026-07-20 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially lea… |
CVE-2026-39385 | | | 2026-07-20 | Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated b… |
CVE-2026-16198 | Medium | 5.6 | 2026-07-19 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go o… |
CVE-2026-57980 | Medium | 5.4 | 2026-07-17 | Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-47481 | Medium | 6.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel… |
CVE-2026-57698 | Medium | 6.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows… |
CVE-2026-57697 | High | 7.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Passwo… |
CVE-2026-57807 | Critical | 9.8 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allow… |
CVE-2026-36028 | Medium | 6.8 | 2026-07-08 | A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset |
CVE-2026-57867 | | | 2026-07-07 | MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate de… |
CVE-2026-5268 | Critical | 9.1 | 2026-07-06 | An authentication bypass vulnerability exists in
the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remot… |
CVE-2025-13475 | Low | 3.5 | 2026-07-04 | In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a use… |
CVE-2026-58517 | Medium | 4.3 | 2026-07-01 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.
This iss… |
CVE-2026-12579 | High | 7.4 | 2026-07-01 | AS228T with Authentication Bypass Vulnerability |
CVE-2026-20460 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected… |
CVE-2026-20459 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2026-58172 | Critical | 9.1 | 2026-06-30 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restr… |
CVE-2026-53576 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) t… |
CVE-2026-56029 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. |
CVE-2026-55666 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/mete… |
CVE-2026-33543 | | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intende… |
CVE-2026-53622 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection th… |
CVE-2026-48491 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNI… |
CVE-2026-48020 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middle… |
CVE-2026-56243 | High | 8.1 | 2026-06-23 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header desp… |
CVE-2020-37255 | High | 7.5 | 2026-06-20 | WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by se… |
CVE-2019-25763 | Critical | 9.8 | 2026-06-20 | WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by explo… |
CVE-2026-50194 | High | 8.2 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints… |
CVE-2026-54817 | Medium | 6.5 | 2026-06-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.
This issue affects MSt… |
CVE-2026-54804 | High | 7.6 | 2026-06-17 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. |
CVE-2026-49767 | Critical | 9.8 | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. |
CVE-2026-49071 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. |
CVE-2026-42629 | High | 8.8 | 2026-06-17 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. |
CVE-2026-25439 | High | 8.1 | 2026-06-17 | Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions. |
CVE-2026-12225 | | | 2026-06-16 | syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid cre… |
CVE-2026-49764 | Critical | 9.8 | 2026-06-15 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. |
CVE-2026-48970 | High | 8.1 | 2026-06-15 | Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. |
CVE-2026-42668 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions. |
CVE-2026-42411 | High | 8.1 | 2026-06-15 | Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions. |
CVE-2026-42378 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions. |
CVE-2026-40799 | Medium | 5.3 | 2026-06-15 | Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions. |
CVE-2026-40790 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions. |
CVE-2026-40785 | High | 7.1 | 2026-06-15 | Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. |
CVE-2026-40781 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions. |
CVE-2026-39450 | High | 7.1 | 2026-06-15 | Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. |
CVE-2026-49062 | High | 8.8 | 2026-06-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation.
This issue affects Faust.J… |
CVE-2026-47200 | Medium | 5.3 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server… |
CVE-2026-10523 | Critical | 9.9 | 2026-06-09 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to… |
CVE-2026-5415 | High | 8.8 | 2026-06-05 | The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication… |
CVE-2026-36175 | Medium | 6.8 | 2026-06-04 | An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the b… |
CVE-2026-42654 | High | 7.1 | 2026-06-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation.
This… |
CVE-2026-40780 | High | 7.5 | 2026-06-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation.
This issue affe… |
CVE-2026-45577 | | | 2026-05-29 | Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when… |
CVE-2025-41273 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in… |
CVE-2026-8697 | High | 8.8 | 2026-05-28 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts a… |
CVE-2026-8990 | | | 2026-05-28 | A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owne… |
CVE-2026-35090 | | | 2026-05-27 | In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a… |
CVE-2026-35087 | | | 2026-05-27 | Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the app… |
CVE-2026-42760 | High | 7.5 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recover… |
CVE-2026-42749 | High | 7.1 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows… |
CVE-2026-42745 | High | 7.3 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypa… |
CVE-2026-42735 | High | 8.2 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exp… |
CVE-2025-68711 | Low | 2.4 | 2026-05-26 | AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN… |
CVE-2025-68708 | Low | 2.4 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an… |
CVE-2025-68710 | Low | 2.4 | 2026-05-26 | Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock… |
CVE-2026-45217 | Medium | 6.5 | 2026-05-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitatio… |
CVE-2026-33843 | Critical | 9.1 | 2026-05-22 | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n… |
CVE-2026-8598 | Critical | 9.1 | 2026-05-20 | An undocumented configuration export port is accessible on some models
of ZKTeco CCTV cameras. This port does not require authentication and
exposes critical… |
CVE-2026-24207 | Critical | 9.8 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh… |
CVE-2026-24206 | High | 7.3 | 2026-05-20 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh… |
CVE-2026-4320 | | | 2026-05-18 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HT… |
CVE-2026-4524 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2026-45109 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-… |
CVE-2026-44575 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middlewar… |
CVE-2026-44574 | High | 8.1 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protec… |