CWE-289

36 CVEs classified under CWE-289. Browse by severity and year.

Top CVEs for CWE-289
CVESeverityScorePublishedSummary
CVE-2026-53622Critical10.02026-06-23Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection th…
CVE-2026-39858Critical10.02026-04-30Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerabi…
CVE-2026-9701Critical9.82026-07-08The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plainte…
CVE-2026-24058Critical9.82026-01-22Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an att…
CVE-2025-13613Critical9.82025-12-10The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not prop…
CVE-2024-56511Critical9.82025-01-10DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter…
CVE-2023-1803Critical9.82023-04-14Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Rout…
CVE-2021-34746Critical9.82021-09-02A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow a…
CVE-2025-29266Critical9.62025-03-31Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host netw…
CVE-2026-50627Critical9.12026-06-12The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one R…
CVE-2025-55130Critical9.12026-01-20A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By…
CVE-2023-20046High8.82023-05-09A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an…
CVE-2017-16590High8.82018-01-23This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User…
CVE-2026-44492High8.62026-06-11Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROX…
CVE-2024-55634High8.12024-12-10A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 be…
CVE-2025-64343High7.82025-11-07(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory…
CVE-2025-41248High7.52025-09-16The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type wit…
CVE-2024-11283High7.52025-03-14The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_c…
CVE-2024-51996High7.52024-11-13Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony do…
CVE-2024-2098High7.52024-06-13The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' func…